5e8296e3db9f6b6823b20453aa5b9c4642152c4321c11fefb89d543b331b669d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe
Size

564KB
MD5

8fbd67ad9301652c66a8a56cc4dff877
SHA1

0b43c3d819260431117d223157addb80a9a03da8
SHA256

5e8296e3db9f6b6823b20453aa5b9c4642152c4321c11fefb89d543b331b669d
SHA512

216b6ad7d78b2dfcd582e3a4a2581873523d6e58b52908f69e97d18295b99edb6fd298615384225848592bbb0136fc0c233caa790d33ad302d602699e04034f6
SSDEEP

12288:XjVc811paI0gQ96Dtng/MRXPUkebTmyvTkjs:XJc+1pbfQ96png+PUkETJg4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	bbdcabebgbif.exe

Loads dropped DLL 10 IoCs

pid	Process
2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe
2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe
2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	2160	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2288	wmic.exe
Token: SeSecurityPrivilege	2288	wmic.exe
Token: SeTakeOwnershipPrivilege	2288	wmic.exe
Token: SeLoadDriverPrivilege	2288	wmic.exe
Token: SeSystemProfilePrivilege	2288	wmic.exe
Token: SeSystemtimePrivilege	2288	wmic.exe
Token: SeProfSingleProcessPrivilege	2288	wmic.exe
Token: SeIncBasePriorityPrivilege	2288	wmic.exe
Token: SeCreatePagefilePrivilege	2288	wmic.exe
Token: SeBackupPrivilege	2288	wmic.exe
Token: SeRestorePrivilege	2288	wmic.exe
Token: SeShutdownPrivilege	2288	wmic.exe
Token: SeDebugPrivilege	2288	wmic.exe
Token: SeSystemEnvironmentPrivilege	2288	wmic.exe
Token: SeRemoteShutdownPrivilege	2288	wmic.exe
Token: SeUndockPrivilege	2288	wmic.exe
Token: SeManageVolumePrivilege	2288	wmic.exe
Token: 33	2288	wmic.exe
Token: 34	2288	wmic.exe
Token: 35	2288	wmic.exe
Token: SeIncreaseQuotaPrivilege	2288	wmic.exe
Token: SeSecurityPrivilege	2288	wmic.exe
Token: SeTakeOwnershipPrivilege	2288	wmic.exe
Token: SeLoadDriverPrivilege	2288	wmic.exe
Token: SeSystemProfilePrivilege	2288	wmic.exe
Token: SeSystemtimePrivilege	2288	wmic.exe
Token: SeProfSingleProcessPrivilege	2288	wmic.exe
Token: SeIncBasePriorityPrivilege	2288	wmic.exe
Token: SeCreatePagefilePrivilege	2288	wmic.exe
Token: SeBackupPrivilege	2288	wmic.exe
Token: SeRestorePrivilege	2288	wmic.exe
Token: SeShutdownPrivilege	2288	wmic.exe
Token: SeDebugPrivilege	2288	wmic.exe
Token: SeSystemEnvironmentPrivilege	2288	wmic.exe
Token: SeRemoteShutdownPrivilege	2288	wmic.exe
Token: SeUndockPrivilege	2288	wmic.exe
Token: SeManageVolumePrivilege	2288	wmic.exe
Token: 33	2288	wmic.exe
Token: 34	2288	wmic.exe
Token: 35	2288	wmic.exe
Token: SeIncreaseQuotaPrivilege	2292	wmic.exe
Token: SeSecurityPrivilege	2292	wmic.exe
Token: SeTakeOwnershipPrivilege	2292	wmic.exe
Token: SeLoadDriverPrivilege	2292	wmic.exe
Token: SeSystemProfilePrivilege	2292	wmic.exe
Token: SeSystemtimePrivilege	2292	wmic.exe
Token: SeProfSingleProcessPrivilege	2292	wmic.exe
Token: SeIncBasePriorityPrivilege	2292	wmic.exe
Token: SeCreatePagefilePrivilege	2292	wmic.exe
Token: SeBackupPrivilege	2292	wmic.exe
Token: SeRestorePrivilege	2292	wmic.exe
Token: SeShutdownPrivilege	2292	wmic.exe
Token: SeDebugPrivilege	2292	wmic.exe
Token: SeSystemEnvironmentPrivilege	2292	wmic.exe
Token: SeRemoteShutdownPrivilege	2292	wmic.exe
Token: SeUndockPrivilege	2292	wmic.exe
Token: SeManageVolumePrivilege	2292	wmic.exe
Token: 33	2292	wmic.exe
Token: 34	2292	wmic.exe
Token: 35	2292	wmic.exe
Token: SeIncreaseQuotaPrivilege	2788	wmic.exe
Token: SeSecurityPrivilege	2788	wmic.exe
Token: SeTakeOwnershipPrivilege	2788	wmic.exe
Token: SeLoadDriverPrivilege	2788	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2160	2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2160	2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2160	2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2160	2172	8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2288	2160	bbdcabebgbif.exe	29
PID 2160 wrote to memory of 2288	2160	bbdcabebgbif.exe	29
PID 2160 wrote to memory of 2288	2160	bbdcabebgbif.exe	29
PID 2160 wrote to memory of 2288	2160	bbdcabebgbif.exe	29
PID 2160 wrote to memory of 2292	2160	bbdcabebgbif.exe	32
PID 2160 wrote to memory of 2292	2160	bbdcabebgbif.exe	32
PID 2160 wrote to memory of 2292	2160	bbdcabebgbif.exe	32
PID 2160 wrote to memory of 2292	2160	bbdcabebgbif.exe	32
PID 2160 wrote to memory of 2788	2160	bbdcabebgbif.exe	34
PID 2160 wrote to memory of 2788	2160	bbdcabebgbif.exe	34
PID 2160 wrote to memory of 2788	2160	bbdcabebgbif.exe	34
PID 2160 wrote to memory of 2788	2160	bbdcabebgbif.exe	34
PID 2160 wrote to memory of 2692	2160	bbdcabebgbif.exe	36
PID 2160 wrote to memory of 2692	2160	bbdcabebgbif.exe	36
PID 2160 wrote to memory of 2692	2160	bbdcabebgbif.exe	36
PID 2160 wrote to memory of 2692	2160	bbdcabebgbif.exe	36
PID 2160 wrote to memory of 2476	2160	bbdcabebgbif.exe	38
PID 2160 wrote to memory of 2476	2160	bbdcabebgbif.exe	38
PID 2160 wrote to memory of 2476	2160	bbdcabebgbif.exe	38
PID 2160 wrote to memory of 2476	2160	bbdcabebgbif.exe	38
PID 2160 wrote to memory of 1164	2160	bbdcabebgbif.exe	40
PID 2160 wrote to memory of 1164	2160	bbdcabebgbif.exe	40
PID 2160 wrote to memory of 1164	2160	bbdcabebgbif.exe	40
PID 2160 wrote to memory of 1164	2160	bbdcabebgbif.exe	40

C:\Users\Admin\AppData\Local\Temp\8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fbd67ad9301652c66a8a56cc4dff877_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\bbdcabebgbif.exe
  C:\Users\Admin\AppData\Local\Temp\bbdcabebgbif.exe /PID=0 /SUBPID=0 /NETWORKID=0 /DISTID=0 /CID=0 /PRODUCT_ID=0 /SERVER_URL=`omn7).`ip`[o're_,]pnn%ok_`e-_ok /CLICKID= /D1=-1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /THANKYOU_URL= /TIME=1415012652 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /HIDEX=1 /IS_DYNAMIC_ENCRYPTED=true
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91717369293.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91717369293.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91717369293.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91717369293.txt bios get version
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91717369293.txt bios get version
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 364
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\91717369293.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst2D1A.tmp\ll.dll

Filesize
113KB

MD5
e59a731e0e538728b68d76f2b69d8eee

SHA1
1c08ab1fa933a099bac7615d83e2253fb6533e49

SHA256
a0120f6aaeea92ff215375acf0690f3d38318178fa911275e3c88a8a1a0fe388

SHA512
8d3c022d7437c10598fb1f2c8bae5a21ff4e4f3cb842250b51d88569d3a3bb89097c9c9d55d8019630631ca77b82032c089beb9973ecc8a4cdb3f9b6f4d4e360

Download Submit
\Users\Admin\AppData\Local\Temp\bbdcabebgbif.exe

Filesize
810KB

MD5
8a3a83b70574dad10967fd8e6460b2c0

SHA1
4f2b2b1c278790f0d85ebddff427df1a86f16a32

SHA256
19f992a73d6bb0510f3b6d1e05bbe17893815781bcf7e87a70a96570007ec17d

SHA512
1f5f569e88c772e03784156b96406c35d18f685cf9752f8d002dcae41af1205c5a937cc16b7d7d3c2916627bf6bf9331939a185333d425d8a33120f6ea211eb3

Download Submit
\Users\Admin\AppData\Local\Temp\nst2D1A.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit