d7604f4d245bf3521a1e70aa4191db496cf0095ece368f1a4b1fb6825b66e8c7

General

Target

b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Size

793KB
MD5

b2898066b6f6c833c1047ab5e30c3575
SHA1

ac45c3ccaa6857469a4e33765149b49904d1aac5
SHA256

d7604f4d245bf3521a1e70aa4191db496cf0095ece368f1a4b1fb6825b66e8c7
SHA512

ef3568d984e477d9f2292f76b10f34e72496c8cc48555aab13332dd2963785936f5a5a48344b4b1252f6afd1ee6029e277d6f0454c2dba54aba6e2b24834fb50
SSDEEP

12288:iAf2vJmTR7QxTRoMgurL5fAor9QPUtZcQcC4rAT6TXSBgM71N9cuy:ixv0kTRoMgu9XBPvXTIM7Xg

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2260	1092	WerFault.exe	80
412	1092	WerFault.exe	80
1944	1092	WerFault.exe	80
3456	1092	WerFault.exe	80
3432	1092	WerFault.exe	80
384	1092	WerFault.exe	80
4444	1092	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeSecurityPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeBackupPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeRestorePrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeShutdownPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeDebugPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeUndockPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: 33	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: 34	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: 35	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Token: 36	1092	b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe"
1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 520
  2⤵
  - Program crash
  PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 592
  2⤵
  - Program crash
  PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 888
  2⤵
  - Program crash
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 892
  2⤵
  - Program crash
  PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1092
  2⤵
  - Program crash
  PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 896
  2⤵
  - Program crash
  PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1096
  2⤵
  - Program crash
  PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1092 -ip 1092
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1092 -ip 1092
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1092 -ip 1092
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1092 -ip 1092
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1092 -ip 1092
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1092 -ip 1092
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1092 -ip 1092
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-0-0x00000000021C0000-0x0000000002282000-memory.dmp

Filesize
776KB

Download
memory/1092-1-0x00000000021C0000-0x0000000002282000-memory.dmp

Filesize
776KB

Download
memory/1092-2-0x0000000000484000-0x0000000000485000-memory.dmp

Filesize
4KB

Download
memory/1092-3-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-4-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-5-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-6-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-7-0x0000000000484000-0x0000000000485000-memory.dmp

Filesize
4KB

Download
memory/1092-9-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-10-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads