8176c502088cfa9f7a8cd7a8fa7ad442f4ac184a86884a1a383cb8f395de0089

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe
Size

662KB
MD5

095c2dcd76090783d35d62d2ce11284a
SHA1

a903fd25b1a65a04d774572c364e897ffaeca60e
SHA256

8176c502088cfa9f7a8cd7a8fa7ad442f4ac184a86884a1a383cb8f395de0089
SHA512

5f73c85e9ba919039eb4a9695001a42204541b242f8988320db0e04e0463aeaf390987c2dfc1a518ea1801758115c173f2113474a10a2cb5af4c24771e0d52c6
SSDEEP

12288:vSAf4IMbdZLk7Q9ZipwFeQrjSJ87Sqvxx70HCyBItWfc8vy4hj:vS84Fzip0eHWnyBE86C

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	beechcijca.exe

Loads dropped DLL 7 IoCs

pid	Process
2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe
2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe
2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2704	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beechcijca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2684	wmic.exe
Token: SeSecurityPrivilege	2684	wmic.exe
Token: SeTakeOwnershipPrivilege	2684	wmic.exe
Token: SeLoadDriverPrivilege	2684	wmic.exe
Token: SeSystemProfilePrivilege	2684	wmic.exe
Token: SeSystemtimePrivilege	2684	wmic.exe
Token: SeProfSingleProcessPrivilege	2684	wmic.exe
Token: SeIncBasePriorityPrivilege	2684	wmic.exe
Token: SeCreatePagefilePrivilege	2684	wmic.exe
Token: SeBackupPrivilege	2684	wmic.exe
Token: SeRestorePrivilege	2684	wmic.exe
Token: SeShutdownPrivilege	2684	wmic.exe
Token: SeDebugPrivilege	2684	wmic.exe
Token: SeSystemEnvironmentPrivilege	2684	wmic.exe
Token: SeRemoteShutdownPrivilege	2684	wmic.exe
Token: SeUndockPrivilege	2684	wmic.exe
Token: SeManageVolumePrivilege	2684	wmic.exe
Token: 33	2684	wmic.exe
Token: 34	2684	wmic.exe
Token: 35	2684	wmic.exe
Token: SeIncreaseQuotaPrivilege	2684	wmic.exe
Token: SeSecurityPrivilege	2684	wmic.exe
Token: SeTakeOwnershipPrivilege	2684	wmic.exe
Token: SeLoadDriverPrivilege	2684	wmic.exe
Token: SeSystemProfilePrivilege	2684	wmic.exe
Token: SeSystemtimePrivilege	2684	wmic.exe
Token: SeProfSingleProcessPrivilege	2684	wmic.exe
Token: SeIncBasePriorityPrivilege	2684	wmic.exe
Token: SeCreatePagefilePrivilege	2684	wmic.exe
Token: SeBackupPrivilege	2684	wmic.exe
Token: SeRestorePrivilege	2684	wmic.exe
Token: SeShutdownPrivilege	2684	wmic.exe
Token: SeDebugPrivilege	2684	wmic.exe
Token: SeSystemEnvironmentPrivilege	2684	wmic.exe
Token: SeRemoteShutdownPrivilege	2684	wmic.exe
Token: SeUndockPrivilege	2684	wmic.exe
Token: SeManageVolumePrivilege	2684	wmic.exe
Token: 33	2684	wmic.exe
Token: 34	2684	wmic.exe
Token: 35	2684	wmic.exe
Token: SeIncreaseQuotaPrivilege	2824	wmic.exe
Token: SeSecurityPrivilege	2824	wmic.exe
Token: SeTakeOwnershipPrivilege	2824	wmic.exe
Token: SeLoadDriverPrivilege	2824	wmic.exe
Token: SeSystemProfilePrivilege	2824	wmic.exe
Token: SeSystemtimePrivilege	2824	wmic.exe
Token: SeProfSingleProcessPrivilege	2824	wmic.exe
Token: SeIncBasePriorityPrivilege	2824	wmic.exe
Token: SeCreatePagefilePrivilege	2824	wmic.exe
Token: SeBackupPrivilege	2824	wmic.exe
Token: SeRestorePrivilege	2824	wmic.exe
Token: SeShutdownPrivilege	2824	wmic.exe
Token: SeDebugPrivilege	2824	wmic.exe
Token: SeSystemEnvironmentPrivilege	2824	wmic.exe
Token: SeRemoteShutdownPrivilege	2824	wmic.exe
Token: SeUndockPrivilege	2824	wmic.exe
Token: SeManageVolumePrivilege	2824	wmic.exe
Token: 33	2824	wmic.exe
Token: 34	2824	wmic.exe
Token: 35	2824	wmic.exe
Token: SeIncreaseQuotaPrivilege	2612	wmic.exe
Token: SeSecurityPrivilege	2612	wmic.exe
Token: SeTakeOwnershipPrivilege	2612	wmic.exe
Token: SeLoadDriverPrivilege	2612	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2704	2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2704	2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2704	2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2704	2640	095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2684	2704	beechcijca.exe	32
PID 2704 wrote to memory of 2684	2704	beechcijca.exe	32
PID 2704 wrote to memory of 2684	2704	beechcijca.exe	32
PID 2704 wrote to memory of 2684	2704	beechcijca.exe	32
PID 2704 wrote to memory of 2824	2704	beechcijca.exe	35
PID 2704 wrote to memory of 2824	2704	beechcijca.exe	35
PID 2704 wrote to memory of 2824	2704	beechcijca.exe	35
PID 2704 wrote to memory of 2824	2704	beechcijca.exe	35
PID 2704 wrote to memory of 2612	2704	beechcijca.exe	37
PID 2704 wrote to memory of 2612	2704	beechcijca.exe	37
PID 2704 wrote to memory of 2612	2704	beechcijca.exe	37
PID 2704 wrote to memory of 2612	2704	beechcijca.exe	37
PID 2704 wrote to memory of 2828	2704	beechcijca.exe	39
PID 2704 wrote to memory of 2828	2704	beechcijca.exe	39
PID 2704 wrote to memory of 2828	2704	beechcijca.exe	39
PID 2704 wrote to memory of 2828	2704	beechcijca.exe	39
PID 2704 wrote to memory of 1436	2704	beechcijca.exe	41
PID 2704 wrote to memory of 1436	2704	beechcijca.exe	41
PID 2704 wrote to memory of 1436	2704	beechcijca.exe	41
PID 2704 wrote to memory of 1436	2704	beechcijca.exe	41
PID 2704 wrote to memory of 2884	2704	beechcijca.exe	43
PID 2704 wrote to memory of 2884	2704	beechcijca.exe	43
PID 2704 wrote to memory of 2884	2704	beechcijca.exe	43
PID 2704 wrote to memory of 2884	2704	beechcijca.exe	43

C:\Users\Admin\AppData\Local\Temp\095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\095c2dcd76090783d35d62d2ce11284a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\beechcijca.exe
  C:\Users\Admin\AppData\Local\Temp\beechcijca.exe 6\5\4\9\6\4\1\0\7\5\4 KUtFOzcsHy9MUD5KREA0KhwuTj5PU0lNR0A+OTAlKytsbGpgbF1wbWFmYDlMYGVkW2NkICg/RU1PRTs3LjY3Ki0cKT5FOzcsHy9JTUs+UD9LWUVDPSsxNS4uHCZNQVFWPk1bT01INGJwc3AzKittbXIlPkFSSyZPS0ooPUdKKkhOP0ocKT5IQD1HSEQ2Gys+LDkkKxwuRCs4KSsbKzstOSwxGSpALjgpKBorQzU2KC0aKkxJSUBUQ01aTExEUjg9VTwgKEtOST9ROk5bRFVFPDkaKkxJSUBUQ01aSjtIQTQaK0RYPlpRTEc5FylBV0VYPkk+R0VFPzkfL0FKT05aPklJU1JFSzgxGipQPztKSllIUFtPTUg0GitVTTYtHCk/Tyg3HC5STklQQ0hBVlFBS0NISEFDSD0+P1FRTDYbK0NOW0lPSlNJRkA5bm1xXBorUUVNUE5IREo+WVFSRUtaQDtUTzQsHC5IQj9BUjgtFylFUl89VEo7SEU6WUFNQ0tUTE5AQDRgXWtzXhsrPkpTRUZLQERYREw3LSwvKC0wMCc0LygsLikaK09BSzxIRkBIVkNKUlQ6R0g3YV1jbWEfL01EST84LSsuLjY2KzAxLBsrO0lTTUxIPEBZT0VEPzk4LysrKywrLSwkLzkyKzUvLCVMRA==
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81727851170.txt bios get serialnumber
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81727851170.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81727851170.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81727851170.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2828
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81727851170.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81727851170.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\beechcijca.exe

Filesize
846KB

MD5
822744a6d0bf59dda34f7425edb4de95

SHA1
6891696d9e7a7f1e9b9e6b161910bd43867ec34c

SHA256
1a89f80d40bbb1f2aba7aff553b7c4ffac143dbcbda2295db463829101946276

SHA512
dc842fa990c9bec8b370be1e5472a1c553a89bbbbbe5e50ddce4656a5f8ea500387639e9b2f9afc0ea7505ae8d40576a3b7020706a1966b4c23ae5e53cdd6678

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE2C2.tmp\obzlbgz.dll

Filesize
138KB

MD5
a15922d0097879d72646432c29db2cf9

SHA1
db7e59b5bc4bb6938b1966a9e24895a2ab7cfc66

SHA256
3def3fad22d80662839dc5984f2a8bb2a64f97e5008f51ecb168ca6d29e66a8c

SHA512
cec01e5df136188eac5f41d45eecb7aa169052c2ec57021c2f475e625d5df88b7f76487be63bc5068de0abe666b3dfa6fde4960128a9539620fd5697b4d78dab

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE2C2.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit