Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 10:41

General

  • Target

    8dcad29b897891ddbe76ecab6ef48fe4_JaffaCakes118.exe

  • Size

    557KB

  • MD5

    8dcad29b897891ddbe76ecab6ef48fe4

  • SHA1

    c7984240608202b837bdc6e9f9426b76b0d31d4b

  • SHA256

    13817334b617b2f91aa1b8f7bf46b39952669fa433212bb470e80ba50a71540a

  • SHA512

    891cb30d1e9287f6b2853aaced0b1e998a29e591471797db79d1f5a5c85517f9dd1e1df999300457279776249327b3199efba1bee9f3c3be3bdcfc2b8e6168b7

  • SSDEEP

    12288:unHO3irw4GZule7+NnUacqprKPLrU4841U2jo:uHIwwL4e7+NnUaPpyvV1U2k

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8dcad29b897891ddbe76ecab6ef48fe4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8dcad29b897891ddbe76ecab6ef48fe4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Users\Admin\AppData\Local\Temp\eicabfbcicfd.exe
      C:\Users\Admin\AppData\Local\Temp\eicabfbcicfd.exe 0-1-5-2-5-3-9-7-6-2-5 L09EQjgvKiwaLU5VQUtHPzonGSlMQFRWSlBGRjs2Kx4qREhOUkRBNCsvNSsxHypBREE0KRotS1JOP1M+UVZCPjssNjgvHipQPEtQQ01fVE1KOGVrbWo4Ki9ybXQpQTxMRStPT08oP0tNJUJIREogLj5KREBCQj47KzA1MjQsLS8xKjAsOTMsNjAvKzAyHipEMDgjLy0cLSpBR0lESVIoQTkmQ0IgNC8gMisdJj0sOygxHypCLjokKhotPzQ8KC8bLDsuNyssIC5LUEpBTDxOXUtSSFE/PlY0GSlOTU9DUEFPXDxORj84IC5LUEpBTDxOXUlBTEA7Gyw8UT9dUFJLOB4qQk8+WUFIREtETEA6FyhCTU5UXj1QSlRKPkw7LSAuT0Y8S0JSSVNaVVFHOxssTUY3MBsvQ04vOB0mS09MT0lMQF1SQkM8SUtASUw8RUBSSUU3HipJUlpQUEtLQkdDOHRxcGMbLEk+TlNNTkhJRVpSSj5MXT9BWE47LR0mQUNCQFg8LB4qRkpYPldJQUxEQVpCRTxMV0tURD87YV5jbF8eKkROUkxHTDg9WUdLPTUrLC0wJSowMSkyMRstT0ZEPjcvLzI3MDAxNSsqGi0/T1ZJSko+O1hOR0hFPC8tMywpKSszJTk5Ky41MSgjSks=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717324872.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1560
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717324872.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717324872.txt bios get version
        3⤵
          PID:2888
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81717324872.txt bios get version
          3⤵
            PID:3612
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81717324872.txt bios get version
            3⤵
              PID:4792
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 956
              3⤵
              • Program crash
              PID:2860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2872 -ip 2872
          1⤵
            PID:1660

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\81717324872.txt

                  Filesize

                  66B

                  MD5

                  9025468f85256136f923096b01375964

                  SHA1

                  7fcd174999661594fa5f88890ffb195e9858cc52

                  SHA256

                  d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

                  SHA512

                  92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

                • C:\Users\Admin\AppData\Local\Temp\81717324872.txt

                  Filesize

                  2B

                  MD5

                  f3b25701fe362ec84616a93a45ce9998

                  SHA1

                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                  SHA256

                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                  SHA512

                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                • C:\Users\Admin\AppData\Local\Temp\81717324872.txt

                  Filesize

                  58B

                  MD5

                  f8e2f71e123c5a848f2a83d2a7aef11e

                  SHA1

                  5e7a9a2937fa4f06fdf3e33d7def7de431c159b4

                  SHA256

                  79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121

                  SHA512

                  8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

                • C:\Users\Admin\AppData\Local\Temp\eicabfbcicfd.exe

                  Filesize

                  764KB

                  MD5

                  286462dd4060b816f673431fe19d9855

                  SHA1

                  0f93f8fb93025b9ddcc4674cf843e7e6bafd2fb9

                  SHA256

                  d67a728d2e997c38fc86e4b3bd63f0b544783794b6274dd9a65f58d8f793882c

                  SHA512

                  91f79d9a07c3eb6af1a71657f9c9c1ca8bb719e22bd365357c335713719c9b5d0eceedc0d9f85bdd1f491d85c27b49defe9f8fe0e3f2e4766c488be308a54011

                • C:\Users\Admin\AppData\Local\Temp\nsl495E.tmp\dnjzh.dll

                  Filesize

                  125KB

                  MD5

                  7d7518d98e68eebbb02ee06a931fd0c6

                  SHA1

                  73a1c22beb0381aa241a4542df29d20a9da5e033

                  SHA256

                  6fd1735c87fd55624f93a5141710324ba6c23788c8804ce387592a6599fe7f14

                  SHA512

                  bb33af0a4b0f21fb13112cdd6880575c5ff7b19b67ec6db74f7c558a7666f8aa34864650313a4e5f56afb239da0d7e1a6c9e6c1d789907aa2c31e930e7103117

                • C:\Users\Admin\AppData\Local\Temp\nsl495E.tmp\nsisunz.dll

                  Filesize

                  40KB

                  MD5

                  5f13dbc378792f23e598079fc1e4422b

                  SHA1

                  5813c05802f15930aa860b8363af2b58426c8adf

                  SHA256

                  6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

                  SHA512

                  9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5