Malware Analysis Report

2025-04-14 02:57

Sample ID 240613-c7jlbs1grd
Target a3927dbc31129dd8ae547e952767efd4_JaffaCakes118
SHA256 06efc07e678a4c4154130f1d865b4848022bbf5945670bc34c1230fec4d953ab
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

06efc07e678a4c4154130f1d865b4848022bbf5945670bc34c1230fec4d953ab

Threat Level: Shows suspicious behavior

The file a3927dbc31129dd8ae547e952767efd4_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Loads dropped DLL

Executes dropped EXE

Enumerates physical storage devices

Program crash

Unsigned PE

NSIS installer

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 02:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 02:42

Reported

2024-06-13 02:45

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 700 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 700 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 700 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 1788 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1788 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe

C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe 7/7/5/2/8/6/8/1/5/3/4 KElEQjUwKzcbLE9OO0tHPDcoHypLQU1QSlBDQzw8LB0rPUJOUkE+NTQvMRwoPERCNSoYLktPSz1OPlJXQzw8LzMtGShOQ0pQPVFaUk5FNmNybGoyLipwbm8nP0NLRSVTSk0pOklLLEFIPk4bLD9FQj5JQT41HypBLTYtLi8xLSk4GyxAKzYxNysaJ0MuOikqGSpCLDclMBssQC42KC8YKUhRSkFRPE1aTkpDTkA+VjkZKEtQRz5NQk9cQU5FPDsYKUhRSkFRPE1aTDlHPTxIbG5tWmcjKipDbmhfXW0eLS4sHyovS2AhKyk8cFtbXGQgLyxGYmlnGCk9V0BcUUtFOB4nP1BEWkBJPUVETD03GC5DTE9NWD1QR1FLRE06LBkoT0Y5SENYSlJbTktHOxgpTkw4LxwoPU4vNRonUVBLUEJGQF1PP0RCSkpBQkY8RT1PSks4HStCTFpQTUhMSEhCOW1rcGMYKUpET1JOR0JJRVdPS0RNXEA6Uk47KhonR0RBQVE2LB4nQ0teP1ZKOkZEQVc/RkJNVkxNPj87XltkcmAdKz1IUkxESTlDWkZMNjAtLCkoKTgxKy0xLRstSDtKQEdJQUVYRExLTjlLRzpwa25gHidOQUxAOi0tLDI2Ky4oNDEdKz1IUkxESTlDWlFFRj44NScsLS4tLS0uIy04KioyNDEnTEY=

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246583.txt bios get serialnumber

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246583.txt bios get version

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246583.txt bios get version

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246583.txt bios get version

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246583.txt bios get version

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 952

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 srv.desk-top-app.info udp

Files

C:\Users\Admin\AppData\Local\Temp\nse6BF9.tmp\enycizl.dll

MD5 14f4e2ba434249b6232cca6099fb96fe
SHA1 73c7348bdd896d208d2ba899b633f670a809eb10
SHA256 92c435c33c683141144640a2c2d64cbc52a063101b1a5da7f49fa2f8dc1891cb
SHA512 4f918de0fa34ff803fc939fc8b98aabab740f69618fbb92f61f6db97ed04a18423eaf2f8660191a2967132e77b12d9a6f973b1037bc6a2f1bab50560b9c79276

C:\Users\Admin\AppData\Local\Temp\nse6BF9.tmp\ZipDLL.dll

MD5 2dc35ddcabcb2b24919b9afae4ec3091
SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe

MD5 65a591fe26b2d0dc345b66ccf3bdc4cf
SHA1 ecac1a49c096326c3a6b306727d52db3d268ab02
SHA256 4c8c3627e732019e65ab4ba2f5dbbafd6db4a6e0b98d002b1a527e60f1eb15f7
SHA512 ad719f9f31bd1fd29ad20ad43ff6d944ba5841cab1579f3cade15b89606c602129512f1328dde114d568e3cded33bab8cc32762560b523083b47d47cae0a2ba4

C:\Users\Admin\AppData\Local\Temp\81718246583.txt

MD5 9025468f85256136f923096b01375964
SHA1 7fcd174999661594fa5f88890ffb195e9858cc52
SHA256 d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA512 92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

C:\Users\Admin\AppData\Local\Temp\81718246583.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Temp\81718246583.txt

MD5 f8e2f71e123c5a848f2a83d2a7aef11e
SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 02:42

Reported

2024-06-13 02:45

Platform

win7-20240221-en

Max time kernel

122s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 224

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-13 02:42

Reported

2024-06-13 02:45

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

149s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3056 wrote to memory of 4584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3056 wrote to memory of 4584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3056 wrote to memory of 4584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4584 -ip 4584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3976,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-13 02:42

Reported

2024-06-13 02:45

Platform

win7-20240611-en

Max time kernel

122s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 224

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-13 02:42

Reported

2024-06-13 02:45

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3964 wrote to memory of 4000 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3964 wrote to memory of 4000 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3964 wrote to memory of 4000 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4000 -ip 4000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 02:42

Reported

2024-06-13 02:45

Platform

win7-20240611-en

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2932 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 2932 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 2932 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 2932 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe
PID 2800 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2800 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\WerFault.exe
PID 2800 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\WerFault.exe
PID 2800 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\WerFault.exe
PID 2800 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe

C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe 7/7/5/2/8/6/8/1/5/3/4 KElEQjUwKzcbLE9OO0tHPDcoHypLQU1QSlBDQzw8LB0rPUJOUkE+NTQvMRwoPERCNSoYLktPSz1OPlJXQzw8LzMtGShOQ0pQPVFaUk5FNmNybGoyLipwbm8nP0NLRSVTSk0pOklLLEFIPk4bLD9FQj5JQT41HypBLTYtLi8xLSk4GyxAKzYxNysaJ0MuOikqGSpCLDclMBssQC42KC8YKUhRSkFRPE1aTkpDTkA+VjkZKEtQRz5NQk9cQU5FPDsYKUhRSkFRPE1aTDlHPTxIbG5tWmcjKipDbmhfXW0eLS4sHyovS2AhKyk8cFtbXGQgLyxGYmlnGCk9V0BcUUtFOB4nP1BEWkBJPUVETD03GC5DTE9NWD1QR1FLRE06LBkoT0Y5SENYSlJbTktHOxgpTkw4LxwoPU4vNRonUVBLUEJGQF1PP0RCSkpBQkY8RT1PSks4HStCTFpQTUhMSEhCOW1rcGMYKUpET1JOR0JJRVdPS0RNXEA6Uk47KhonR0RBQVE2LB4nQ0teP1ZKOkZEQVc/RkJNVkxNPj87XltkcmAdKz1IUkxESTlDWkZMNjAtLCkoKTgxKy0xLRstSDtKQEdJQUVYRExLTjlLRzpwa25gHidOQUxAOi0tLDI2Ky4oNDEdKz1IUkxESTlDWlFFRj44NScsLS4tLS0uIy04KioyNDEnTEY=

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246585.txt bios get serialnumber

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246585.txt bios get version

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246585.txt bios get version

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246585.txt bios get version

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic /output:C:\Users\Admin\AppData\Local\Temp\81718246585.txt bios get version

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 372

Network

Country Destination Domain Proto
US 8.8.8.8:53 srv.desk-top-app.info udp

Files

C:\Users\Admin\AppData\Local\Temp\nsd9A1E.tmp\enycizl.dll

MD5 14f4e2ba434249b6232cca6099fb96fe
SHA1 73c7348bdd896d208d2ba899b633f670a809eb10
SHA256 92c435c33c683141144640a2c2d64cbc52a063101b1a5da7f49fa2f8dc1891cb
SHA512 4f918de0fa34ff803fc939fc8b98aabab740f69618fbb92f61f6db97ed04a18423eaf2f8660191a2967132e77b12d9a6f973b1037bc6a2f1bab50560b9c79276

\Users\Admin\AppData\Local\Temp\nsd9A1E.tmp\ZipDLL.dll

MD5 2dc35ddcabcb2b24919b9afae4ec3091
SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

C:\Users\Admin\AppData\Local\Temp\bedhicfhdh.exe

MD5 65a591fe26b2d0dc345b66ccf3bdc4cf
SHA1 ecac1a49c096326c3a6b306727d52db3d268ab02
SHA256 4c8c3627e732019e65ab4ba2f5dbbafd6db4a6e0b98d002b1a527e60f1eb15f7
SHA512 ad719f9f31bd1fd29ad20ad43ff6d944ba5841cab1579f3cade15b89606c602129512f1328dde114d568e3cded33bab8cc32762560b523083b47d47cae0a2ba4

C:\Users\Admin\AppData\Local\Temp\81718246585.txt

MD5 9025468f85256136f923096b01375964
SHA1 7fcd174999661594fa5f88890ffb195e9858cc52
SHA256 d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA512 92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51