12812395d82e03f322b09b0d045d36a8ca3c48e8ee3ea590d35928531f7f15bb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe
Size 575KB
Sample240613-alnbaazgrp
SHA256 12812395d82e03f322b09b0d045d36a8ca3c48e8ee3ea590d35928531f7f15bb
MD5 a31afcad6439c613f41a85780adc1fb1
SHA1 835850c1bcd12240b82978a5873737fd91b5a1c5
SHA512 d7b07351801b68de8c94cdf74d495b56aca0d3cc1108a671e6b055b7044495366ffce4da75481109106eb77e0e3a45419816349d745bc31bdf7c136b5bf661e7
SSDEEP 12288:6pUmImXYptz6aKI3Z/Ag3/WAxFPBO7cBh99q9ySWGNJMf+VERjAmljc:6WoKzSIJ/hvFjPBQcBh99qcSzNWfyyA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4408	bbchcabecaeg.exe

Loads dropped DLL 2 IoCs

pid	Process
1668	a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe
1668	a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1132	4408	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3336	wmic.exe
Token: SeSecurityPrivilege	3336	wmic.exe
Token: SeTakeOwnershipPrivilege	3336	wmic.exe
Token: SeLoadDriverPrivilege	3336	wmic.exe
Token: SeSystemProfilePrivilege	3336	wmic.exe
Token: SeSystemtimePrivilege	3336	wmic.exe
Token: SeProfSingleProcessPrivilege	3336	wmic.exe
Token: SeIncBasePriorityPrivilege	3336	wmic.exe
Token: SeCreatePagefilePrivilege	3336	wmic.exe
Token: SeBackupPrivilege	3336	wmic.exe
Token: SeRestorePrivilege	3336	wmic.exe
Token: SeShutdownPrivilege	3336	wmic.exe
Token: SeDebugPrivilege	3336	wmic.exe
Token: SeSystemEnvironmentPrivilege	3336	wmic.exe
Token: SeRemoteShutdownPrivilege	3336	wmic.exe
Token: SeUndockPrivilege	3336	wmic.exe
Token: SeManageVolumePrivilege	3336	wmic.exe
Token: 33	3336	wmic.exe
Token: 34	3336	wmic.exe
Token: 35	3336	wmic.exe
Token: 36	3336	wmic.exe
Token: SeIncreaseQuotaPrivilege	3336	wmic.exe
Token: SeSecurityPrivilege	3336	wmic.exe
Token: SeTakeOwnershipPrivilege	3336	wmic.exe
Token: SeLoadDriverPrivilege	3336	wmic.exe
Token: SeSystemProfilePrivilege	3336	wmic.exe
Token: SeSystemtimePrivilege	3336	wmic.exe
Token: SeProfSingleProcessPrivilege	3336	wmic.exe
Token: SeIncBasePriorityPrivilege	3336	wmic.exe
Token: SeCreatePagefilePrivilege	3336	wmic.exe
Token: SeBackupPrivilege	3336	wmic.exe
Token: SeRestorePrivilege	3336	wmic.exe
Token: SeShutdownPrivilege	3336	wmic.exe
Token: SeDebugPrivilege	3336	wmic.exe
Token: SeSystemEnvironmentPrivilege	3336	wmic.exe
Token: SeRemoteShutdownPrivilege	3336	wmic.exe
Token: SeUndockPrivilege	3336	wmic.exe
Token: SeManageVolumePrivilege	3336	wmic.exe
Token: 33	3336	wmic.exe
Token: 34	3336	wmic.exe
Token: 35	3336	wmic.exe
Token: 36	3336	wmic.exe
Token: SeIncreaseQuotaPrivilege	3184	wmic.exe
Token: SeSecurityPrivilege	3184	wmic.exe
Token: SeTakeOwnershipPrivilege	3184	wmic.exe
Token: SeLoadDriverPrivilege	3184	wmic.exe
Token: SeSystemProfilePrivilege	3184	wmic.exe
Token: SeSystemtimePrivilege	3184	wmic.exe
Token: SeProfSingleProcessPrivilege	3184	wmic.exe
Token: SeIncBasePriorityPrivilege	3184	wmic.exe
Token: SeCreatePagefilePrivilege	3184	wmic.exe
Token: SeBackupPrivilege	3184	wmic.exe
Token: SeRestorePrivilege	3184	wmic.exe
Token: SeShutdownPrivilege	3184	wmic.exe
Token: SeDebugPrivilege	3184	wmic.exe
Token: SeSystemEnvironmentPrivilege	3184	wmic.exe
Token: SeRemoteShutdownPrivilege	3184	wmic.exe
Token: SeUndockPrivilege	3184	wmic.exe
Token: SeManageVolumePrivilege	3184	wmic.exe
Token: 33	3184	wmic.exe
Token: 34	3184	wmic.exe
Token: 35	3184	wmic.exe
Token: 36	3184	wmic.exe
Token: SeIncreaseQuotaPrivilege	3184	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4408	1668	a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe	81
PID 1668 wrote to memory of 4408	1668	a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe	81
PID 1668 wrote to memory of 4408	1668	a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe	81
PID 4408 wrote to memory of 3336	4408	bbchcabecaeg.exe	83
PID 4408 wrote to memory of 3336	4408	bbchcabecaeg.exe	83
PID 4408 wrote to memory of 3336	4408	bbchcabecaeg.exe	83
PID 4408 wrote to memory of 3184	4408	bbchcabecaeg.exe	87
PID 4408 wrote to memory of 3184	4408	bbchcabecaeg.exe	87
PID 4408 wrote to memory of 3184	4408	bbchcabecaeg.exe	87
PID 4408 wrote to memory of 1460	4408	bbchcabecaeg.exe	90
PID 4408 wrote to memory of 1460	4408	bbchcabecaeg.exe	90
PID 4408 wrote to memory of 1460	4408	bbchcabecaeg.exe	90
PID 4408 wrote to memory of 1796	4408	bbchcabecaeg.exe	92
PID 4408 wrote to memory of 1796	4408	bbchcabecaeg.exe	92
PID 4408 wrote to memory of 1796	4408	bbchcabecaeg.exe	92
PID 4408 wrote to memory of 2956	4408	bbchcabecaeg.exe	94
PID 4408 wrote to memory of 2956	4408	bbchcabecaeg.exe	94
PID 4408 wrote to memory of 2956	4408	bbchcabecaeg.exe	94

C:\Users\Admin\AppData\Local\Temp\a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a31afcad6439c613f41a85780adc1fb1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\bbchcabecaeg.exe
  C:\Users\Admin\AppData\Local\Temp\bbchcabecaeg.exe /PID=13013 /SUBPID=0 /NETWORKID=0 /DISTID=24749 /CID=0 /PRODUCT_ID=2936 /SERVER_URL=`omn7).enqoYgeco(oldmrfgh_a(bkm /CLICKID=d2fa5e5f-9f62-480f-8669-91e636bda085 /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=0 /THANKYOU_URL= /TIME=1417063418 /VM=2 /DS1=]`^cbdunebpk /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /HIDEX=1 /IS_DYNAMIC_ENCRYPTED=true
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81718237893.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81718237893.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81718237893.txt bios get version
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81718237893.txt bios get version
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81718237893.txt bios get version
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1196
    3⤵
    - Program crash
    PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4408 -ip 4408
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81718237893.txt

Path C:\Users\Admin\AppData\Local\Temp\81718237893.txt
Size 66B
SHA256 d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
MD5 9025468f85256136f923096b01375964
SHA1 7fcd174999661594fa5f88890ffb195e9858cc52
SHA512 92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
MD5 SHA1 SHA512

Submit Download

81718237893.txt

Path C:\Users\Admin\AppData\Local\Temp\81718237893.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

81718237893.txt

Path C:\Users\Admin\AppData\Local\Temp\81718237893.txt
Size 58B
SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
MD5 f8e2f71e123c5a848f2a83d2a7aef11e
SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
MD5 SHA1 SHA512

Submit Download

bbchcabecaeg.exe

Path C:\Users\Admin\AppData\Local\Temp\bbchcabecaeg.exe
Size 810KB
SHA256 10bf5a2c049caccda678b9a0301beb44abe13918fc4284fe935e94e6f8553cf7
MD5 a999c62bb85bcac28631b3f27b3c761d
SHA1 edbdc09a445b11fdd524e031cd7858868da2ad93
SHA512 41b55d0de6a394dfbe4e76f6413500b501a7a945c28ae1bafa0affe432300ddaedc5f284f02519532fe9d1a06fc27587ddc286730d123ab1920a8cace650acef
SSDEEP 24576:aD8atap7H1szR1dlZpSvHBNKGWaYhoW6VngM75S8C+R:HataRH1sz3dfpSvHB0GWNhz6VgMNnC+R
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsisunz.dll

Path C:\Users\Admin\AppData\Local\Temp\nss34FB.tmp\nsisunz.dll
Size 40KB
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
MD5 SHA1 SHA512 SSDEEP

Submit Download

zzr.dll

Path C:\Users\Admin\AppData\Local\Temp\nss34FB.tmp\zzr.dll
Size 121KB
SHA256 0386a934807991dbf80a74b2cfce3df02917e6118558555d44f8caddd250c1e4
MD5 c3724b2d1a24b4e4bf53d28865d6d80b
SHA1 e522e36b04e6764d3920bcdb903b9fed31432d87
SHA512 6973e9b92802e1a7804a38c86dee5a42b46dadcf8f418642115ab64673ad5885de7058dfed63856acfb514e2959f92b1a76396b1ac41d47e6b55bb200ed321ee
SSDEEP 1536:MYcNVhz/CkSL/l6uWRL4bGhB5YdQYIWSTuf1IhzE0nOBA4ean2bNL:M37z/CxDa7BYISfS2rveW2bZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads