Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
23f7122d422b250416eb2bfa3404bf38
-
SHA1
ebfebc8985eb47018009482c12c813df100307ea
-
SHA256
1dc875aa7ec750d2496dfd9ceb8a1e2f8cc40d3aa7c0fa39107a3b6ced3f99c3
-
SHA512
f6f9f6957939654f4f28a96c2ac6f7f569aa5897dc599937365998601adff48a10e5a5ee8cabccaa1c7890eb59f173447a577146df1f9792a19c1aa59461983f
-
SSDEEP
49152:m7E13iVcFEhEbXD2Y2DqIWN5+kNvjXE2wMw1weOhlR:m7E13hFJD2Y2D5WpNvjX177lR
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 728 23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe 2900 MsiExec.exe 2900 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1580 msiexec.exe Token: SeIncreaseQuotaPrivilege 1580 msiexec.exe Token: SeSecurityPrivilege 2364 msiexec.exe Token: SeCreateTokenPrivilege 1580 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1580 msiexec.exe Token: SeLockMemoryPrivilege 1580 msiexec.exe Token: SeIncreaseQuotaPrivilege 1580 msiexec.exe Token: SeMachineAccountPrivilege 1580 msiexec.exe Token: SeTcbPrivilege 1580 msiexec.exe Token: SeSecurityPrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeLoadDriverPrivilege 1580 msiexec.exe Token: SeSystemProfilePrivilege 1580 msiexec.exe Token: SeSystemtimePrivilege 1580 msiexec.exe Token: SeProfSingleProcessPrivilege 1580 msiexec.exe Token: SeIncBasePriorityPrivilege 1580 msiexec.exe Token: SeCreatePagefilePrivilege 1580 msiexec.exe Token: SeCreatePermanentPrivilege 1580 msiexec.exe Token: SeBackupPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeShutdownPrivilege 1580 msiexec.exe Token: SeDebugPrivilege 1580 msiexec.exe Token: SeAuditPrivilege 1580 msiexec.exe Token: SeSystemEnvironmentPrivilege 1580 msiexec.exe Token: SeChangeNotifyPrivilege 1580 msiexec.exe Token: SeRemoteShutdownPrivilege 1580 msiexec.exe Token: SeUndockPrivilege 1580 msiexec.exe Token: SeSyncAgentPrivilege 1580 msiexec.exe Token: SeEnableDelegationPrivilege 1580 msiexec.exe Token: SeManageVolumePrivilege 1580 msiexec.exe Token: SeImpersonatePrivilege 1580 msiexec.exe Token: SeCreateGlobalPrivilege 1580 msiexec.exe Token: SeCreateTokenPrivilege 1580 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1580 msiexec.exe Token: SeLockMemoryPrivilege 1580 msiexec.exe Token: SeIncreaseQuotaPrivilege 1580 msiexec.exe Token: SeMachineAccountPrivilege 1580 msiexec.exe Token: SeTcbPrivilege 1580 msiexec.exe Token: SeSecurityPrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeLoadDriverPrivilege 1580 msiexec.exe Token: SeSystemProfilePrivilege 1580 msiexec.exe Token: SeSystemtimePrivilege 1580 msiexec.exe Token: SeProfSingleProcessPrivilege 1580 msiexec.exe Token: SeIncBasePriorityPrivilege 1580 msiexec.exe Token: SeCreatePagefilePrivilege 1580 msiexec.exe Token: SeCreatePermanentPrivilege 1580 msiexec.exe Token: SeBackupPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeShutdownPrivilege 1580 msiexec.exe Token: SeDebugPrivilege 1580 msiexec.exe Token: SeAuditPrivilege 1580 msiexec.exe Token: SeSystemEnvironmentPrivilege 1580 msiexec.exe Token: SeChangeNotifyPrivilege 1580 msiexec.exe Token: SeRemoteShutdownPrivilege 1580 msiexec.exe Token: SeUndockPrivilege 1580 msiexec.exe Token: SeSyncAgentPrivilege 1580 msiexec.exe Token: SeEnableDelegationPrivilege 1580 msiexec.exe Token: SeManageVolumePrivilege 1580 msiexec.exe Token: SeImpersonatePrivilege 1580 msiexec.exe Token: SeCreateGlobalPrivilege 1580 msiexec.exe Token: SeCreateTokenPrivilege 1580 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1580 msiexec.exe Token: SeLockMemoryPrivilege 1580 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1580 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 728 wrote to memory of 1580 728 23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe 90 PID 728 wrote to memory of 1580 728 23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe 90 PID 2364 wrote to memory of 2900 2364 msiexec.exe 93 PID 2364 wrote to memory of 2900 2364 msiexec.exe 93 PID 2364 wrote to memory of 2900 2364 msiexec.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\system32\msiexec.exe/i "C:\Users\Admin\AppData\Roaming\FileSubmit\tulipbouquet\install\B016367\tulipbouquet.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\23f7122d422b250416eb2bfa3404bf38_JaffaCakes118.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1580
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FBAE909A00548DB03E6855ABB802893B C2⤵
- Loads dropped DLL
PID:2900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:81⤵PID:1432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5b759a21d153a42060a53a89a26b9931c
SHA16260cecd55db44d75121b1f88506a4a9978c1b0f
SHA2566adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd
SHA51278bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0
-
Filesize
1.2MB
MD528193c9542f676a881be31a3d7f0bf3c
SHA14d4ea42a5a7da75046766bec5cd573f3e7b70047
SHA256887b5a4a9dc99fea33ae068d1e72cd11ebcf5dab7fcb2aa56f8c372750baffdc
SHA512b2f87a492952eda412bcf085729408e8e81470150f8d8c944739b692f76b607c4abc25b17a6c5cfe4c915101a1d2ad6c55e80d0d04ecf5aaa353ccf888986299
-
Filesize
92KB
MD5c09c157cbcbae2d04d9538eabcaaddf3
SHA100647fbccd19d55412f24b4a91740747cd1793ab
SHA2568762c9520df0958649178b4629372d57eb10d4f0b8ca759eac24009c1496fc1c
SHA51284494b12ab5ccc2455e732b0f4a66886bf6a458100f7d6fe2231799f7246ac48157c2808e4a6e303bcd0d0a2ac127e451d6b119329b05dddf0e26dd2b2801e58