adff68c554df6f01434d2a41cd1279bb9da4873c02414994efcb803d58321ad0

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e00bffcd381b6ad389753768319335_JaffaCakes118.exe
Size

329KB
MD5

22e00bffcd381b6ad389753768319335
SHA1

e45681b58ffa91f8467585283c64b7e474eb762c
SHA256

adff68c554df6f01434d2a41cd1279bb9da4873c02414994efcb803d58321ad0
SHA512

d0fe9b6c06068c84d761c33655d45bebb03b9fd3010f4365c9a8d560a0ba705ead93a10629631eee62d82c17d744d3b0ddd897897d522b9425dbd9cd033759bd
SSDEEP

6144:W/g/J/22ZYHFSM/F+Gwl9ENWoN1/DbasIi3wyEPGsjxDMfamohf5OIvfkD:W/g/J/HYHFmEdSsIDyGj6ymohf0yM

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2572	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2780	pbzixdus.exe

Loads dropped DLL 3 IoCs

pid	Process
2572	cmd.exe
2572	cmd.exe
2780	pbzixdus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2252	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2584	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe
2780	pbzixdus.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2572	3012	22e00bffcd381b6ad389753768319335_JaffaCakes118.exe	28
PID 3012 wrote to memory of 2572	3012	22e00bffcd381b6ad389753768319335_JaffaCakes118.exe	28
PID 3012 wrote to memory of 2572	3012	22e00bffcd381b6ad389753768319335_JaffaCakes118.exe	28
PID 3012 wrote to memory of 2572	3012	22e00bffcd381b6ad389753768319335_JaffaCakes118.exe	28
PID 2572 wrote to memory of 2252	2572	cmd.exe	30
PID 2572 wrote to memory of 2252	2572	cmd.exe	30
PID 2572 wrote to memory of 2252	2572	cmd.exe	30
PID 2572 wrote to memory of 2252	2572	cmd.exe	30
PID 2572 wrote to memory of 2584	2572	cmd.exe	32
PID 2572 wrote to memory of 2584	2572	cmd.exe	32
PID 2572 wrote to memory of 2584	2572	cmd.exe	32
PID 2572 wrote to memory of 2584	2572	cmd.exe	32
PID 2572 wrote to memory of 2780	2572	cmd.exe	33
PID 2572 wrote to memory of 2780	2572	cmd.exe	33
PID 2572 wrote to memory of 2780	2572	cmd.exe	33
PID 2572 wrote to memory of 2780	2572	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\22e00bffcd381b6ad389753768319335_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22e00bffcd381b6ad389753768319335_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 3012 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\22e00bffcd381b6ad389753768319335_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\pbzixdus.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 3012
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2584
- - C:\Users\Admin\AppData\Local\pbzixdus.exe
    C:\Users\Admin\AppData\Local\pbzixdus.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\pbzixdus.exe

Filesize
329KB

MD5
22e00bffcd381b6ad389753768319335

SHA1
e45681b58ffa91f8467585283c64b7e474eb762c

SHA256
adff68c554df6f01434d2a41cd1279bb9da4873c02414994efcb803d58321ad0

SHA512
d0fe9b6c06068c84d761c33655d45bebb03b9fd3010f4365c9a8d560a0ba705ead93a10629631eee62d82c17d744d3b0ddd897897d522b9425dbd9cd033759bd

Download Submit
memory/2780-16-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-18-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-21-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-20-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-19-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-17-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-14-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/2780-15-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/3012-0-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/3012-1-0x000000000109D000-0x000000000109E000-memory.dmp

Filesize
4KB

Download
memory/3012-2-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/3012-7-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/3012-3-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/3012-4-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download