Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe
-
Size
758KB
-
MD5
14f834063c40133fdefcdbd19a7812c8
-
SHA1
1160b1bf5c5ad7da930e61cb551567d46c776978
-
SHA256
ca49d40f50afa04de7070c16f4c85a92eeed5e5dcbb03b59d0c416f2b5fa2d92
-
SHA512
883565109505dc171247f8dcfd1d98b9043308055e8bd1be3c2efee8dee90fdd32a85be476259f29047ac8bf9f0334bfef96c79cd7b10a40c010ebfbbe99bcf1
-
SSDEEP
12288:yzSF3nFo/1NATB7Ilv18BqIWioYcpVVpEeiO0kDjy6eindvQr:zpnqfATtIEiCGpxioS2Qr
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exedescription pid process target process PID 2756 set thread context of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier vbc.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2408 vbc.exe Token: SeSecurityPrivilege 2408 vbc.exe Token: SeTakeOwnershipPrivilege 2408 vbc.exe Token: SeLoadDriverPrivilege 2408 vbc.exe Token: SeSystemProfilePrivilege 2408 vbc.exe Token: SeSystemtimePrivilege 2408 vbc.exe Token: SeProfSingleProcessPrivilege 2408 vbc.exe Token: SeIncBasePriorityPrivilege 2408 vbc.exe Token: SeCreatePagefilePrivilege 2408 vbc.exe Token: SeBackupPrivilege 2408 vbc.exe Token: SeRestorePrivilege 2408 vbc.exe Token: SeShutdownPrivilege 2408 vbc.exe Token: SeDebugPrivilege 2408 vbc.exe Token: SeSystemEnvironmentPrivilege 2408 vbc.exe Token: SeChangeNotifyPrivilege 2408 vbc.exe Token: SeRemoteShutdownPrivilege 2408 vbc.exe Token: SeUndockPrivilege 2408 vbc.exe Token: SeManageVolumePrivilege 2408 vbc.exe Token: SeImpersonatePrivilege 2408 vbc.exe Token: SeCreateGlobalPrivilege 2408 vbc.exe Token: 33 2408 vbc.exe Token: 34 2408 vbc.exe Token: 35 2408 vbc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exedescription pid process target process PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2756 wrote to memory of 2408 2756 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2408