Analysis

  • max time kernel
    134s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 01:03

General

  • Target

    8c66a81919e6a85068e0f83059323d5a_JaffaCakes118.exe

  • Size

    558KB

  • MD5

    8c66a81919e6a85068e0f83059323d5a

  • SHA1

    b7e37918ecce0f792266ae01fe68d152062b1f5e

  • SHA256

    311121bbed782ab0bd9eeccb57d8d9acfd675497f3c2669ece662e67503b2382

  • SHA512

    9e3004777235ded900183285fc098b97e37d1c608faf2a3018156a754cc3dbd843f2f7a8ee43cde8ee55f0821c24b98bbc67d64ba05f21d91a958cdee867513b

  • SSDEEP

    12288:mgNUq9NaS5NC3bTewq1rf9vYEj99M3ZgFFTZxa5IQ18qcHAJdgW:mtq9k8C3veHr9F99MpmtZAJ18qcG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c66a81919e6a85068e0f83059323d5a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8c66a81919e6a85068e0f83059323d5a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\1430611339.exe
      C:\Users\Admin\AppData\Local\Temp\1430611339.exe 0#2#1#4#9#4#0#9#2#5#0 L05IQDQzMycwGy9TU0FMQEA9Jx4qTkVSVktJR0k7OywgL0JIT0tFRDQwLzU0MR8rOkVENC4bL1BQTkBMP1RWRz89MTQ4MBcrUzxQUUVSXVROQzloa3JrOi8tcm5tKkQ8UUYtVE1PKThMUCVHSUZPHi4/Q0VDQkc/PTI2ODMwNTEsMS0gL0IwOSg0MC0zGy9EMDwpKBwvOzE4LTEeLkArOS0oHipENTssLRcrUElNP1VDUl5MSUVWOEFUPSAtT05GQFU6UlpFVUpAORcrUElNP1VDUl5KOElFNB4qRVhDXlFJSD0XLUBYRV1CSTtISUVDOCAvRk5PS1tCSU1SU0VQPC4XK1Q/P0lLWU1UW0xOTDQeKlZNOzEcJkBTKDsbL1JTTVBASUVWVUBMQ01MQUBJQT5DUFJMOx8rQE9fSVNJVElLRDlrbnVcHipSRVJUTkVFTj5dUFNFUF5AOFVTNDAbL0hHQ0FPOTEXLURTX0JYSjhJSTpdQE5DUFhMS0FENGRcbHNjHys7S1dFSkpBRF1ITDQtMywsKy4yNy0tJzIgJlJETUU7MDAqLDYoNDA4Mh4uQEZTTkNNPERfUkhJPDk1JjEqMjAvNCYoNjIwOC8yKj9MHCZRQTRLanppamtdHC5mLCwrKyhVaGpba3dqKUlUKzQtLhwvYiJVSlc2MignOGxwY2NSZWJJaHAcLmYsMTIuMzQqJEJEVERKIDJjKWtlYmErPmNea28nKj9fbm9kYyAyZjIvKicqMikvLy4xLzQnSl1mWHBkJTJkNC8uKjMtHipVUko8ZGtwcBwxXCUyZCQuXWNlaywrMTE3ZCpgamZmIy1mUnNtUGBpZTttcm5sbWBgRF1uWGVgcl9iZGxja3kcMGExNDEvMigyNS40IDJmLzMvJzIxLTMyNiUwZS0rLzAtLzE1NzQkL10xNCszLDEzMzcwLFVtPXVIakEjMV5ZUGdtSnRzdEdsPStJVER3R3lzZ1l2XnBNYU91SldxM0dKRmZDQmZ0TXc3LURlRllfQlJlWDFSXUxEPC9JQzgvTT9udExwLmdhR0BwVmFndEBWVWxheHZ0
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717290200.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4272
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717290200.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4488
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717290200.txt bios get version
        3⤵
          PID:4884
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81717290200.txt bios get version
          3⤵
            PID:3228
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81717290200.txt bios get version
            3⤵
              PID:1660
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 964
              3⤵
              • Program crash
              PID:1148
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 536 -ip 536
          1⤵
            PID:1256

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\1430611339.exe

                  Filesize

                  764KB

                  MD5

                  74cef7d7c576ac82610f035cf64948c5

                  SHA1

                  18025d461bad7e6630a840e773a1682aec84a677

                  SHA256

                  e6f064ef2c59a18106222839ca23ec68bd4dc935af65d78bd76854717598b845

                  SHA512

                  f1387c2630f212aed38f6dc825609b706cf5a467e8522985208b84b17c8d8554e386a41620a0750e2e0ff8bb4a6dcafd764773121698e38bb2c841d9e8915016

                • C:\Users\Admin\AppData\Local\Temp\81717290200.txt

                  Filesize

                  66B

                  MD5

                  9025468f85256136f923096b01375964

                  SHA1

                  7fcd174999661594fa5f88890ffb195e9858cc52

                  SHA256

                  d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

                  SHA512

                  92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

                • C:\Users\Admin\AppData\Local\Temp\81717290200.txt

                  Filesize

                  2B

                  MD5

                  f3b25701fe362ec84616a93a45ce9998

                  SHA1

                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                  SHA256

                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                  SHA512

                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                • C:\Users\Admin\AppData\Local\Temp\81717290200.txt

                  Filesize

                  58B

                  MD5

                  f8e2f71e123c5a848f2a83d2a7aef11e

                  SHA1

                  5e7a9a2937fa4f06fdf3e33d7def7de431c159b4

                  SHA256

                  79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121

                  SHA512

                  8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

                • C:\Users\Admin\AppData\Local\Temp\nsi686F.tmp\dhihhg.dll

                  Filesize

                  126KB

                  MD5

                  09c0a8445c727b6cdee796a9a58b5482

                  SHA1

                  e654bd7418601f7205b2632c8bf32c29295384f9

                  SHA256

                  e363e4886f4a87644efc9a2515c0a98c054f50b02fc5fb58b540e041ad0d70d3

                  SHA512

                  3a43a904ea11bc1b70580da33196073e6f3a53841342ff755845f4eff94f4009b1fd496a57b2a38f36bb9dadbb87af92ca8ab9222547d780db081dc0a6ae0b85

                • C:\Users\Admin\AppData\Local\Temp\nsi686F.tmp\nsisunz.dll

                  Filesize

                  40KB

                  MD5

                  5f13dbc378792f23e598079fc1e4422b

                  SHA1

                  5813c05802f15930aa860b8363af2b58426c8adf

                  SHA256

                  6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

                  SHA512

                  9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5