Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 06:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/kmxoeuy.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/kmxoeuy.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe
- Size 726KB
- Sample240613-hemp6ssaml
- SHA256 20293f2776633514809eaa36fbce8b15df345318d138810dc3c152bc2f6359ed
- MD5 a43e67b0ddc5adab5ded86860900f21c
- SHA1 ba89c653e30c102e69ee60cc39536077db3857dd
- SHA512 f9d3600caea2cb030bbce4bcb9809f2227c27f9802856a7ad38159e3892c9744e92d61310b4c6ab1744af4a3264c0972c5e2416ef15d2ba5e73b6ead49fda354
- SSDEEP 12288:vxg70F7VHEzT00SX5/a45JxScoWxi8HHFnX+GsxGDkQA3R//Jfc8vy4h:vuaJEzJEAcop8HlX+LGAI86
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3608 bedfcffdbj.exe - Loads dropped DLL 2 IoCs
pid Process 4108 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 4108 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3120 3608 WerFault.exe 81 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4468 wmic.exe Token: SeSecurityPrivilege 4468 wmic.exe Token: SeTakeOwnershipPrivilege 4468 wmic.exe Token: SeLoadDriverPrivilege 4468 wmic.exe Token: SeSystemProfilePrivilege 4468 wmic.exe Token: SeSystemtimePrivilege 4468 wmic.exe Token: SeProfSingleProcessPrivilege 4468 wmic.exe Token: SeIncBasePriorityPrivilege 4468 wmic.exe Token: SeCreatePagefilePrivilege 4468 wmic.exe Token: SeBackupPrivilege 4468 wmic.exe Token: SeRestorePrivilege 4468 wmic.exe Token: SeShutdownPrivilege 4468 wmic.exe Token: SeDebugPrivilege 4468 wmic.exe Token: SeSystemEnvironmentPrivilege 4468 wmic.exe Token: SeRemoteShutdownPrivilege 4468 wmic.exe Token: SeUndockPrivilege 4468 wmic.exe Token: SeManageVolumePrivilege 4468 wmic.exe Token: 33 4468 wmic.exe Token: 34 4468 wmic.exe Token: 35 4468 wmic.exe Token: 36 4468 wmic.exe Token: SeIncreaseQuotaPrivilege 4468 wmic.exe Token: SeSecurityPrivilege 4468 wmic.exe Token: SeTakeOwnershipPrivilege 4468 wmic.exe Token: SeLoadDriverPrivilege 4468 wmic.exe Token: SeSystemProfilePrivilege 4468 wmic.exe Token: SeSystemtimePrivilege 4468 wmic.exe Token: SeProfSingleProcessPrivilege 4468 wmic.exe Token: SeIncBasePriorityPrivilege 4468 wmic.exe Token: SeCreatePagefilePrivilege 4468 wmic.exe Token: SeBackupPrivilege 4468 wmic.exe Token: SeRestorePrivilege 4468 wmic.exe Token: SeShutdownPrivilege 4468 wmic.exe Token: SeDebugPrivilege 4468 wmic.exe Token: SeSystemEnvironmentPrivilege 4468 wmic.exe Token: SeRemoteShutdownPrivilege 4468 wmic.exe Token: SeUndockPrivilege 4468 wmic.exe Token: SeManageVolumePrivilege 4468 wmic.exe Token: 33 4468 wmic.exe Token: 34 4468 wmic.exe Token: 35 4468 wmic.exe Token: 36 4468 wmic.exe Token: SeIncreaseQuotaPrivilege 2980 wmic.exe Token: SeSecurityPrivilege 2980 wmic.exe Token: SeTakeOwnershipPrivilege 2980 wmic.exe Token: SeLoadDriverPrivilege 2980 wmic.exe Token: SeSystemProfilePrivilege 2980 wmic.exe Token: SeSystemtimePrivilege 2980 wmic.exe Token: SeProfSingleProcessPrivilege 2980 wmic.exe Token: SeIncBasePriorityPrivilege 2980 wmic.exe Token: SeCreatePagefilePrivilege 2980 wmic.exe Token: SeBackupPrivilege 2980 wmic.exe Token: SeRestorePrivilege 2980 wmic.exe Token: SeShutdownPrivilege 2980 wmic.exe Token: SeDebugPrivilege 2980 wmic.exe Token: SeSystemEnvironmentPrivilege 2980 wmic.exe Token: SeRemoteShutdownPrivilege 2980 wmic.exe Token: SeUndockPrivilege 2980 wmic.exe Token: SeManageVolumePrivilege 2980 wmic.exe Token: 33 2980 wmic.exe Token: 34 2980 wmic.exe Token: 35 2980 wmic.exe Token: 36 2980 wmic.exe Token: SeIncreaseQuotaPrivilege 2980 wmic.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4108 wrote to memory of 3608 4108 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 81 PID 4108 wrote to memory of 3608 4108 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 81 PID 4108 wrote to memory of 3608 4108 a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe 81 PID 3608 wrote to memory of 4468 3608 bedfcffdbj.exe 82 PID 3608 wrote to memory of 4468 3608 bedfcffdbj.exe 82 PID 3608 wrote to memory of 4468 3608 bedfcffdbj.exe 82 PID 3608 wrote to memory of 2980 3608 bedfcffdbj.exe 87 PID 3608 wrote to memory of 2980 3608 bedfcffdbj.exe 87 PID 3608 wrote to memory of 2980 3608 bedfcffdbj.exe 87 PID 3608 wrote to memory of 1268 3608 bedfcffdbj.exe 90 PID 3608 wrote to memory of 1268 3608 bedfcffdbj.exe 90 PID 3608 wrote to memory of 1268 3608 bedfcffdbj.exe 90 PID 3608 wrote to memory of 4508 3608 bedfcffdbj.exe 92 PID 3608 wrote to memory of 4508 3608 bedfcffdbj.exe 92 PID 3608 wrote to memory of 4508 3608 bedfcffdbj.exe 92 PID 3608 wrote to memory of 1224 3608 bedfcffdbj.exe 94 PID 3608 wrote to memory of 1224 3608 bedfcffdbj.exe 94 PID 3608 wrote to memory of 1224 3608 bedfcffdbj.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a43e67b0ddc5adab5ded86860900f21c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\bedfcffdbj.exeC:\Users\Admin\AppData\Local\Temp\bedfcffdbj.exe 5#2#3#9#9#6#7#1#9#0#4 Kk5GOzQsKjIuMBwqUVI5R0M9PCszNTQyNhcmSD5TTk9ORkdBNCcaKENAU1BEQjopLjMpLxcvP0RCOicXKUlRRkRRPlJcQDs3KzUrODMbLVA8SVA+UVZVTkc7ZWtrajMuJnNucSxBPEpFJlNGUCk8Tk0lQEg/ThcvP0dHQEJAPjYxLDQ0LTAuLC8sKjMqNS4xMi4sJxooQyg9MC43NiswGihDKT0pLB4sOyo3JjAXL0AvOyooFyk9NDQtLRstTUlGPk5CS19MTUdTODpTNh8mUE5KQlI6S1k+VENBORstTUlGPk5CS19KPEtCNBcpPlc8X1FNSjoXJj9RRFZDST9KRkU8NxkuP09PT10/SUZRTERJPS4bLVE/OEhEWEZVW1BQSTQXKU9MNDIcKkJQKDRwaHVYcnFfa3RfYG5eHyZSUUlSRkQ8WVBEQ0NLSENGRDhBPlRJTDkbLUZKVkxOTUtJSUA7cWlsXxkuSUVQUFBLQEVBWFRKRU5aQj5QSjcrHyZIRT9DVTQoGihISl9AVEw+REA9WERFQ05UTlE8OzdfYGNzYRstQUZOSEVOOERbRE46KCwrJzEpNiosNzUlKC4rHyZURUhDOigrLS4xLTQtNDUdJjtJUE1DTz0/XVFARD82NSYyMSowLSgsJDE5KTk2MDUnR0Q=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260750.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260750.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260750.txt bios get version3⤵PID:1268
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260750.txt bios get version3⤵PID:4508
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718260750.txt bios get version3⤵PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 6083⤵
- Program crash
PID:3120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3608 -ip 36081⤵PID:2440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\81718260750.txt
- Size 66B
- SHA256 d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
- MD5 9025468f85256136f923096b01375964
- SHA1 7fcd174999661594fa5f88890ffb195e9858cc52
- SHA512 92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81718260750.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81718260750.txt
- Size 58B
- SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
- MD5 f8e2f71e123c5a848f2a83d2a7aef11e
- SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
- SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\bedfcffdbj.exe
- Size 1.1MB
- SHA256 eef16a02184bed0424055d1879da3e855c64ed69cc7b93a62c9628e7ca2d066c
- MD5 8cd270642a2c9b1b53044755bd5b1451
- SHA1 9fc507f5b31adf34fbaa7619c0a1c4f9c18b0870
- SHA512 26a2ffedd27b53c6300d65711b4688f86df697b7577f3c19066f09839ed9ed0b82d1a713506a51d1b3eac2a13a34ffe0afe05966daf8a4e321ba069096bb6801
- SSDEEP 24576:u+xeEu7wTljJBDn6IqbibxhyOh+WHdiddbUoYM1sO5yLv5w1KPCZl6DLG:uweLEDr6wF1dYjqO5y75w1KPCZUDLG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj29E0.tmp\ZipDLL.dll
- Size 163KB
- SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
- MD5 2dc35ddcabcb2b24919b9afae4ec3091
- SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
- SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
- SSDEEP 3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj29E0.tmp\kmxoeuy.dll
- Size 170KB
- SHA256 30a89499e7e11968a6cd0fbd40e9b50d10fb8d66a0715aaec651a552039c702f
- MD5 15633cb17a79403bd79062ddb5e8a027
- SHA1 bccb2e48d09ccd74b729b346ab69e00eacb6bb3d
- SHA512 643855e40317f601e507ecb6b6793187e52cb77b20d81b61208d156a8841171dd7cf2d1bc59bbaceab8a143cdad18677dd672886ef372e6add9282fc742bba08
- SSDEEP 3072:GU5H/7GWh0TUmwiTTLy2Q689+xw2zfMSUj:z5HzGFDTLy2Q/7eZU
- MD5 SHA1 SHA512 SSDEEP