35d772a5df8fedaa8edacdb683e529c6cd13f43ec60a24e8ec62b94e5ef30953

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbaf8416851181463bb932ad0da98995_JaffaCakes118.msi
Size

8.2MB
MD5

bbaf8416851181463bb932ad0da98995
SHA1

82e4c9625b4387d8c07c51a18e511c31eb2c942c
SHA256

35d772a5df8fedaa8edacdb683e529c6cd13f43ec60a24e8ec62b94e5ef30953
SHA512

5a2612b528543558d026a3f6904887d1fce545f35c3e6de4a90083cf2c96085b948742acac820bdc288a660cbb06ee79c2569dabaf8dcaf2eadbacdca09e4011
SSDEEP

196608:JIigROr+1oeB8hJQnhZ/MSjYluHnnL9p3sN7hTy:JIigReXeqJQnj/tauHnn5pcN7hG

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Processes:

msiexec.exe

pid process

2268 msiexec.exe

pid	process
2268	msiexec.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2268	msiexec.exe
Token: SeSecurityPrivilege	3448	msiexec.exe
Token: SeCreateTokenPrivilege	2268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2268	msiexec.exe
Token: SeLockMemoryPrivilege	2268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2268	msiexec.exe
Token: SeMachineAccountPrivilege	2268	msiexec.exe
Token: SeTcbPrivilege	2268	msiexec.exe
Token: SeSecurityPrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeLoadDriverPrivilege	2268	msiexec.exe
Token: SeSystemProfilePrivilege	2268	msiexec.exe
Token: SeSystemtimePrivilege	2268	msiexec.exe
Token: SeProfSingleProcessPrivilege	2268	msiexec.exe
Token: SeIncBasePriorityPrivilege	2268	msiexec.exe
Token: SeCreatePagefilePrivilege	2268	msiexec.exe
Token: SeCreatePermanentPrivilege	2268	msiexec.exe
Token: SeBackupPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeShutdownPrivilege	2268	msiexec.exe
Token: SeDebugPrivilege	2268	msiexec.exe
Token: SeAuditPrivilege	2268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2268	msiexec.exe
Token: SeChangeNotifyPrivilege	2268	msiexec.exe
Token: SeRemoteShutdownPrivilege	2268	msiexec.exe
Token: SeUndockPrivilege	2268	msiexec.exe
Token: SeSyncAgentPrivilege	2268	msiexec.exe
Token: SeEnableDelegationPrivilege	2268	msiexec.exe
Token: SeManageVolumePrivilege	2268	msiexec.exe
Token: SeImpersonatePrivilege	2268	msiexec.exe
Token: SeCreateGlobalPrivilege	2268	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2268 msiexec.exe

pid	process
2268	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bbaf8416851181463bb932ad0da98995_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads