Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 14:33

General

  • Target

    921ff5d9fd9477d3afdc566be67e3d39_JaffaCakes118.exe

  • Size

    685KB

  • MD5

    921ff5d9fd9477d3afdc566be67e3d39

  • SHA1

    12a82a02dbd10222071e6089ac002b8df959e84a

  • SHA256

    242765a98e2f7047ac2e757286e5ab9e1838057dc97cd67f3cd06a363d09a286

  • SHA512

    42ca7f71a1a5ea36ac2adcdd84dc9e4d013b54e08fbaf44b1f361e472070dc8987e13d5afa25491a55441188b21a3f2333cdb0676ef81ce3028772f5b62b56e6

  • SSDEEP

    12288:QoK9p7nzba2CTAQqLCbbFdY+lf9DhBMIfOQeUj5zgWv5Sfc8vy4hFK:QoCPbHCTA/LCvFP93rfORUjms86MK

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\921ff5d9fd9477d3afdc566be67e3d39_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\921ff5d9fd9477d3afdc566be67e3d39_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\bedgaaafeb.exe
      C:\Users\Admin\AppData\Local\Temp\bedgaaafeb.exe 4#2#1#5#8#9#1#7#4#1#2 K05IPzUrMS0yHy1PU0FLQTs8KRwuTEFSVkpKQkg9OTAeK0JITkxAQzYxMjczHi4+QTs8KRwuTk5NQ1A7S15CQDwzLDEzGydKREtSRFBbU1FHNV9zbWw5LStxcXEmO0RMRyxSS04sPEhHLUJKRU0cLUJHQTpKQkA8HitCMDglKB8oQDE7KS8fKjwqPCYtHy1AMjwoKRcuPTE8Ky0eLktKRkNOP1NdTFBIUTk6WDYcLk5OTUNQO0tePlFLPzkeLktKRkNOP1NdSj9MQDUXLj5URF1RUEs4GCZEUUFeQUlCS0RGPDwZK0dNT1JePUpGVkxBUTssHi5PQDhNRFVOU1tTUUc1Fy5PSTwwHC1DTik0HyhOVExQR0xAV05ERT9OS0FHTDw/PFRLSDweK0dSWkpMTU1FTEM5cnFwXRcuS0FTU05MSEk/VlRMQVFdQD9YTjUpHyhESEJBVjwsGCZITFtDV0o/TEQ7VkRHP1FXTFJEPzVdYGVvZB4rQk5SRkNOOkBeR0w7NjImKC8yKjAyLSwwLjAXLkk9UT9ISkRHV0BNTFBASkg7ZVxkamQZK1NHSUM8LCwqNSksNi4uLh8qPEZWR0hOP0BdU0RFPDwwKzMtLi4wMCIoLzMxLzguLik8RQ==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717425225.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2664
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717425225.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717425225.txt bios get version
        3⤵
          PID:2396
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81717425225.txt bios get version
          3⤵
            PID:2908
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81717425225.txt bios get version
            3⤵
              PID:1884
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 368
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:1260

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\81717425225.txt

          Filesize

          66B

          MD5

          9025468f85256136f923096b01375964

          SHA1

          7fcd174999661594fa5f88890ffb195e9858cc52

          SHA256

          d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

          SHA512

          92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

        • C:\Users\Admin\AppData\Local\Temp\81717425225.txt

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\81717425225.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • \Users\Admin\AppData\Local\Temp\bedgaaafeb.exe

          Filesize

          906KB

          MD5

          a593972f8e24bd6f6a0025b79771fbed

          SHA1

          50698ab043446fcb1520f617994bd44a45622e91

          SHA256

          bc19dce053c568bff3c45ce4ca7b4ca37c9ebff6a3ba2bcb5ce77cc66fec3348

          SHA512

          fc24c2071007e7c3eed882d7836b79028387c8481114093f84aa16413b93a96f7aab0cd50214efa474f08315a66dec594321ebadebd4b19455248f77e3032bba

        • \Users\Admin\AppData\Local\Temp\nsy1575.tmp\ZipDLL.dll

          Filesize

          163KB

          MD5

          2dc35ddcabcb2b24919b9afae4ec3091

          SHA1

          9eeed33c3abc656353a7ebd1c66af38cccadd939

          SHA256

          6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

          SHA512

          0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

        • \Users\Admin\AppData\Local\Temp\nsy1575.tmp\gcbaxve.dll

          Filesize

          161KB

          MD5

          5a43c4d89bcaffce49aac328d3f34c40

          SHA1

          28981d8a0b8cd365abff332ae2ed05c1a2c72a52

          SHA256

          a8d48c8c86706fdb03412a59d8df04ab04c2c478e1580dfdee70e03962f16e50

          SHA512

          a4c4d1c5436e28f9c0b9ed30fafb566264d4db673422aca064cb7b859eec6ef04fb72ad226852030757883a2c4292e24c2e1c072ff0eb5a08b751c8a3931382a