Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 06:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/kmxoeuy.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/kmxoeuy.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe
- Size 726KB
- Sample240613-hemp6ssaml
- SHA256 20293f2776633514809eaa36fbce8b15df345318d138810dc3c152bc2f6359ed
- MD5 a43e67b0ddc5adab5ded86860900f21c
- SHA1 ba89c653e30c102e69ee60cc39536077db3857dd
- SHA512 f9d3600caea2cb030bbce4bcb9809f2227c27f9802856a7ad38159e3892c9744e92d61310b4c6ab1744af4a3264c0972c5e2416ef15d2ba5e73b6ead49fda354
- SSDEEP 12288:vxg70F7VHEzT00SX5/a45JxScoWxi8HHFnX+GsxGDkQA3R//Jfc8vy4h:vuaJEzJEAcop8HlX+LGAI86
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2676 bedfcffdbj.exe - Loads dropped DLL 11 IoCs
pid Process 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3064 2676 WerFault.exe 28 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2852 wmic.exe Token: SeSecurityPrivilege 2852 wmic.exe Token: SeTakeOwnershipPrivilege 2852 wmic.exe Token: SeLoadDriverPrivilege 2852 wmic.exe Token: SeSystemProfilePrivilege 2852 wmic.exe Token: SeSystemtimePrivilege 2852 wmic.exe Token: SeProfSingleProcessPrivilege 2852 wmic.exe Token: SeIncBasePriorityPrivilege 2852 wmic.exe Token: SeCreatePagefilePrivilege 2852 wmic.exe Token: SeBackupPrivilege 2852 wmic.exe Token: SeRestorePrivilege 2852 wmic.exe Token: SeShutdownPrivilege 2852 wmic.exe Token: SeDebugPrivilege 2852 wmic.exe Token: SeSystemEnvironmentPrivilege 2852 wmic.exe Token: SeRemoteShutdownPrivilege 2852 wmic.exe Token: SeUndockPrivilege 2852 wmic.exe Token: SeManageVolumePrivilege 2852 wmic.exe Token: 33 2852 wmic.exe Token: 34 2852 wmic.exe Token: 35 2852 wmic.exe Token: SeIncreaseQuotaPrivilege 2852 wmic.exe Token: SeSecurityPrivilege 2852 wmic.exe Token: SeTakeOwnershipPrivilege 2852 wmic.exe Token: SeLoadDriverPrivilege 2852 wmic.exe Token: SeSystemProfilePrivilege 2852 wmic.exe Token: SeSystemtimePrivilege 2852 wmic.exe Token: SeProfSingleProcessPrivilege 2852 wmic.exe Token: SeIncBasePriorityPrivilege 2852 wmic.exe Token: SeCreatePagefilePrivilege 2852 wmic.exe Token: SeBackupPrivilege 2852 wmic.exe Token: SeRestorePrivilege 2852 wmic.exe Token: SeShutdownPrivilege 2852 wmic.exe Token: SeDebugPrivilege 2852 wmic.exe Token: SeSystemEnvironmentPrivilege 2852 wmic.exe Token: SeRemoteShutdownPrivilege 2852 wmic.exe Token: SeUndockPrivilege 2852 wmic.exe Token: SeManageVolumePrivilege 2852 wmic.exe Token: 33 2852 wmic.exe Token: 34 2852 wmic.exe Token: 35 2852 wmic.exe Token: SeIncreaseQuotaPrivilege 1684 wmic.exe Token: SeSecurityPrivilege 1684 wmic.exe Token: SeTakeOwnershipPrivilege 1684 wmic.exe Token: SeLoadDriverPrivilege 1684 wmic.exe Token: SeSystemProfilePrivilege 1684 wmic.exe Token: SeSystemtimePrivilege 1684 wmic.exe Token: SeProfSingleProcessPrivilege 1684 wmic.exe Token: SeIncBasePriorityPrivilege 1684 wmic.exe Token: SeCreatePagefilePrivilege 1684 wmic.exe Token: SeBackupPrivilege 1684 wmic.exe Token: SeRestorePrivilege 1684 wmic.exe Token: SeShutdownPrivilege 1684 wmic.exe Token: SeDebugPrivilege 1684 wmic.exe Token: SeSystemEnvironmentPrivilege 1684 wmic.exe Token: SeRemoteShutdownPrivilege 1684 wmic.exe Token: SeUndockPrivilege 1684 wmic.exe Token: SeManageVolumePrivilege 1684 wmic.exe Token: 33 1684 wmic.exe Token: 34 1684 wmic.exe Token: 35 1684 wmic.exe Token: SeIncreaseQuotaPrivilege 2684 wmic.exe Token: SeSecurityPrivilege 2684 wmic.exe Token: SeTakeOwnershipPrivilege 2684 wmic.exe Token: SeLoadDriverPrivilege 2684 wmic.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2676 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 28 PID 2368 wrote to memory of 2676 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 28 PID 2368 wrote to memory of 2676 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 28 PID 2368 wrote to memory of 2676 2368 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2852 2676 bedfcffdbj.exe 29 PID 2676 wrote to memory of 2852 2676 bedfcffdbj.exe 29 PID 2676 wrote to memory of 2852 2676 bedfcffdbj.exe 29 PID 2676 wrote to memory of 2852 2676 bedfcffdbj.exe 29 PID 2676 wrote to memory of 1684 2676 bedfcffdbj.exe 32 PID 2676 wrote to memory of 1684 2676 bedfcffdbj.exe 32 PID 2676 wrote to memory of 1684 2676 bedfcffdbj.exe 32 PID 2676 wrote to memory of 1684 2676 bedfcffdbj.exe 32 PID 2676 wrote to memory of 2684 2676 bedfcffdbj.exe 34 PID 2676 wrote to memory of 2684 2676 bedfcffdbj.exe 34 PID 2676 wrote to memory of 2684 2676 bedfcffdbj.exe 34 PID 2676 wrote to memory of 2684 2676 bedfcffdbj.exe 34 PID 2676 wrote to memory of 2620 2676 bedfcffdbj.exe 36 PID 2676 wrote to memory of 2620 2676 bedfcffdbj.exe 36 PID 2676 wrote to memory of 2620 2676 bedfcffdbj.exe 36 PID 2676 wrote to memory of 2620 2676 bedfcffdbj.exe 36 PID 2676 wrote to memory of 2276 2676 bedfcffdbj.exe 38 PID 2676 wrote to memory of 2276 2676 bedfcffdbj.exe 38 PID 2676 wrote to memory of 2276 2676 bedfcffdbj.exe 38 PID 2676 wrote to memory of 2276 2676 bedfcffdbj.exe 38 PID 2676 wrote to memory of 3064 2676 bedfcffdbj.exe 40 PID 2676 wrote to memory of 3064 2676 bedfcffdbj.exe 40 PID 2676 wrote to memory of 3064 2676 bedfcffdbj.exe 40 PID 2676 wrote to memory of 3064 2676 bedfcffdbj.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\bedfcffdbj.exeC:\Users\Admin\AppData\Local\Temp\bedfcffdbj.exe 5#2#3#9#9#6#7#1#9#0#4 Kk5GOzQsKjIuMBwqUVI5R0M9PCszNTQyNhcmSD5TTk9ORkdBNCcaKENAU1BEQjopLjMpLxcvP0RCOicXKUlRRkRRPlJcQDs3KzUrODMbLVA8SVA+UVZVTkc7ZWtrajMuJnNucSxBPEpFJlNGUCk8Tk0lQEg/ThcvP0dHQEJAPjYxLDQ0LTAuLC8sKjMqNS4xMi4sJxooQyg9MC43NiswGihDKT0pLB4sOyo3JjAXL0AvOyooFyk9NDQtLRstTUlGPk5CS19MTUdTODpTNh8mUE5KQlI6S1k+VENBORstTUlGPk5CS19KPEtCNBcpPlc8X1FNSjoXJj9RRFZDST9KRkU8NxkuP09PT10/SUZRTERJPS4bLVE/OEhEWEZVW1BQSTQXKU9MNDIcKkJQKDRwaHVYcnFfa3RfYG5eHyZSUUlSRkQ8WVBEQ0NLSENGRDhBPlRJTDkbLUZKVkxOTUtJSUA7cWlsXxkuSUVQUFBLQEVBWFRKRU5aQj5QSjcrHyZIRT9DVTQoGihISl9AVEw+REA9WERFQ05UTlE8OzdfYGNzYRstQUZOSEVOOERbRE46KCwrJzEpNiosNzUlKC4rHyZURUhDOigrLS4xLTQtNDUdJjtJUE1DTz0/XVFARD82NSYyMSowLSgsJDE5KTk2MDUnR0Q=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260749.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260749.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260749.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260749.txt bios get version3⤵PID:2620
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260749.txt bios get version3⤵PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:3064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\81718260749.txt
- Size 66B
- SHA256 d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
- MD5 9025468f85256136f923096b01375964
- SHA1 7fcd174999661594fa5f88890ffb195e9858cc52
- SHA512 92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\bedfcffdbj.exe
- Size 1.1MB
- SHA256 eef16a02184bed0424055d1879da3e855c64ed69cc7b93a62c9628e7ca2d066c
- MD5 8cd270642a2c9b1b53044755bd5b1451
- SHA1 9fc507f5b31adf34fbaa7619c0a1c4f9c18b0870
- SHA512 26a2ffedd27b53c6300d65711b4688f86df697b7577f3c19066f09839ed9ed0b82d1a713506a51d1b3eac2a13a34ffe0afe05966daf8a4e321ba069096bb6801
- SSDEEP 24576:u+xeEu7wTljJBDn6IqbibxhyOh+WHdiddbUoYM1sO5yLv5w1KPCZl6DLG:uweLEDr6wF1dYjqO5y75w1KPCZUDLG
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso1009.tmp\ZipDLL.dll
- Size 163KB
- SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
- MD5 2dc35ddcabcb2b24919b9afae4ec3091
- SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
- SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
- SSDEEP 3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso1009.tmp\kmxoeuy.dll
- Size 170KB
- SHA256 30a89499e7e11968a6cd0fbd40e9b50d10fb8d66a0715aaec651a552039c702f
- MD5 15633cb17a79403bd79062ddb5e8a027
- SHA1 bccb2e48d09ccd74b729b346ab69e00eacb6bb3d
- SHA512 643855e40317f601e507ecb6b6793187e52cb77b20d81b61208d156a8841171dd7cf2d1bc59bbaceab8a143cdad18677dd672886ef372e6add9282fc742bba08
- SSDEEP 3072:GU5H/7GWh0TUmwiTTLy2Q689+xw2zfMSUj:z5HzGFDTLy2Q/7eZU
- MD5 SHA1 SHA512 SSDEEP