Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
befacajhdg_P.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
befacajhdg_P.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe
-
Size
488KB
-
MD5
11a40dc0b07f3ab77fbed271f6696f7d
-
SHA1
662668d077ce79f35275c403a64cf6e30a986bb8
-
SHA256
a1ea4430e3740d10521ab9527bf4b734b253f339b681655ceeeb2b0f741bef6f
-
SHA512
174ce7c6d741c2ef73efc9e26ad841bd34e978393d41d2c5fe688658163ef4b572151466dc9c93766ef6739c912fe31f9428a15ecd1d2149505b76e5eb13c45e
-
SSDEEP
6144:IFJ0PEJ5lAmVzjRmfcRB5edIMsnIzmw/nGWiYjXvhFuzj+h7DJL5qZ4Z+3pZ2ydy:LE2cRXYJzm4nGWXLvLufCxA3p1dy77T
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2972 befacajhdg_P.exe -
Loads dropped DLL 2 IoCs
pid Process 2100 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe 2100 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language befacajhdg_P.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3028 wmic.exe Token: SeSecurityPrivilege 3028 wmic.exe Token: SeTakeOwnershipPrivilege 3028 wmic.exe Token: SeLoadDriverPrivilege 3028 wmic.exe Token: SeSystemProfilePrivilege 3028 wmic.exe Token: SeSystemtimePrivilege 3028 wmic.exe Token: SeProfSingleProcessPrivilege 3028 wmic.exe Token: SeIncBasePriorityPrivilege 3028 wmic.exe Token: SeCreatePagefilePrivilege 3028 wmic.exe Token: SeBackupPrivilege 3028 wmic.exe Token: SeRestorePrivilege 3028 wmic.exe Token: SeShutdownPrivilege 3028 wmic.exe Token: SeDebugPrivilege 3028 wmic.exe Token: SeSystemEnvironmentPrivilege 3028 wmic.exe Token: SeRemoteShutdownPrivilege 3028 wmic.exe Token: SeUndockPrivilege 3028 wmic.exe Token: SeManageVolumePrivilege 3028 wmic.exe Token: 33 3028 wmic.exe Token: 34 3028 wmic.exe Token: 35 3028 wmic.exe Token: SeIncreaseQuotaPrivilege 3028 wmic.exe Token: SeSecurityPrivilege 3028 wmic.exe Token: SeTakeOwnershipPrivilege 3028 wmic.exe Token: SeLoadDriverPrivilege 3028 wmic.exe Token: SeSystemProfilePrivilege 3028 wmic.exe Token: SeSystemtimePrivilege 3028 wmic.exe Token: SeProfSingleProcessPrivilege 3028 wmic.exe Token: SeIncBasePriorityPrivilege 3028 wmic.exe Token: SeCreatePagefilePrivilege 3028 wmic.exe Token: SeBackupPrivilege 3028 wmic.exe Token: SeRestorePrivilege 3028 wmic.exe Token: SeShutdownPrivilege 3028 wmic.exe Token: SeDebugPrivilege 3028 wmic.exe Token: SeSystemEnvironmentPrivilege 3028 wmic.exe Token: SeRemoteShutdownPrivilege 3028 wmic.exe Token: SeUndockPrivilege 3028 wmic.exe Token: SeManageVolumePrivilege 3028 wmic.exe Token: 33 3028 wmic.exe Token: 34 3028 wmic.exe Token: 35 3028 wmic.exe Token: SeIncreaseQuotaPrivilege 2704 wmic.exe Token: SeSecurityPrivilege 2704 wmic.exe Token: SeTakeOwnershipPrivilege 2704 wmic.exe Token: SeLoadDriverPrivilege 2704 wmic.exe Token: SeSystemProfilePrivilege 2704 wmic.exe Token: SeSystemtimePrivilege 2704 wmic.exe Token: SeProfSingleProcessPrivilege 2704 wmic.exe Token: SeIncBasePriorityPrivilege 2704 wmic.exe Token: SeCreatePagefilePrivilege 2704 wmic.exe Token: SeBackupPrivilege 2704 wmic.exe Token: SeRestorePrivilege 2704 wmic.exe Token: SeShutdownPrivilege 2704 wmic.exe Token: SeDebugPrivilege 2704 wmic.exe Token: SeSystemEnvironmentPrivilege 2704 wmic.exe Token: SeRemoteShutdownPrivilege 2704 wmic.exe Token: SeUndockPrivilege 2704 wmic.exe Token: SeManageVolumePrivilege 2704 wmic.exe Token: 33 2704 wmic.exe Token: 34 2704 wmic.exe Token: 35 2704 wmic.exe Token: SeIncreaseQuotaPrivilege 2816 wmic.exe Token: SeSecurityPrivilege 2816 wmic.exe Token: SeTakeOwnershipPrivilege 2816 wmic.exe Token: SeLoadDriverPrivilege 2816 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2972 2100 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe 30 PID 2100 wrote to memory of 2972 2100 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe 30 PID 2100 wrote to memory of 2972 2100 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe 30 PID 2100 wrote to memory of 2972 2100 11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe 30 PID 2972 wrote to memory of 3028 2972 befacajhdg_P.exe 31 PID 2972 wrote to memory of 3028 2972 befacajhdg_P.exe 31 PID 2972 wrote to memory of 3028 2972 befacajhdg_P.exe 31 PID 2972 wrote to memory of 3028 2972 befacajhdg_P.exe 31 PID 2972 wrote to memory of 2704 2972 befacajhdg_P.exe 34 PID 2972 wrote to memory of 2704 2972 befacajhdg_P.exe 34 PID 2972 wrote to memory of 2704 2972 befacajhdg_P.exe 34 PID 2972 wrote to memory of 2704 2972 befacajhdg_P.exe 34 PID 2972 wrote to memory of 2816 2972 befacajhdg_P.exe 36 PID 2972 wrote to memory of 2816 2972 befacajhdg_P.exe 36 PID 2972 wrote to memory of 2816 2972 befacajhdg_P.exe 36 PID 2972 wrote to memory of 2816 2972 befacajhdg_P.exe 36 PID 2972 wrote to memory of 2864 2972 befacajhdg_P.exe 38 PID 2972 wrote to memory of 2864 2972 befacajhdg_P.exe 38 PID 2972 wrote to memory of 2864 2972 befacajhdg_P.exe 38 PID 2972 wrote to memory of 2864 2972 befacajhdg_P.exe 38 PID 2972 wrote to memory of 2756 2972 befacajhdg_P.exe 40 PID 2972 wrote to memory of 2756 2972 befacajhdg_P.exe 40 PID 2972 wrote to memory of 2756 2972 befacajhdg_P.exe 40 PID 2972 wrote to memory of 2756 2972 befacajhdg_P.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11a40dc0b07f3ab77fbed271f6696f7d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exeC:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe 8,9,8,3,5,3,3,6,9,1,0 J0dBQTguNjIrMSAnSk0/S0ZBNycfL0Y8TFRKT0hDOzwwGCY8Rk5RRj40LyAnOkFBOC0dKUdRTzxMO1FaRkE3Jx8vSzxKU0BPXE9JSz1ga2xtNSwsbWl1Ljw8S0goUUxKJEBQSCVBS0FMHSk6S0k7QkFBOB0sPig8LSkXJ0EtOiorFy5EKzQlLhssQS40LDEYJjwyOCouGiZPUkc7TUBPXE1MQFVBO1A1HSpNT0k7VENMVj1SRz46GiZPUkc7TUBPXEs7REQ9GCY9VUBcUkxDPCAnPFBCWkBKPkNITj00GCxDTFBOVkFSR05LQk06MhomU0g5RUNWSlJcT0lLPRgmTko4Lx0pO1IxNRcnT1BLUUNERF9PPERASkpCQ0RARz1MSkk4HSxDSl5STUVMRkhCOm5pdGUYJkpCT1JPSEBNR1dMS0JNXEE7UFI9KhcnRURBQlI0MCAnQEtcP1ZLO0RIQ1c8RkBNVk1OPEM9XlhkcGAdLD5GVk5ERjlBWkZNNykvOCYoKS0pNjAoKDEyGCZIPk0+SUY8S19BRUtRPElJN2txdV0XJ1FESkI3KDM1KCksMzM0NBomQ09PRURMPEFcTkBMRTUoKiwsMywsJzA1Ii0yLyw3LjEhQE0=2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81728012372.txt bios get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81728012372.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81728012372.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81728012372.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2864
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81728012372.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
674KB
MD5fa589ac7920c04eff43238d6cd6068ec
SHA13a3896dbf780c8af638d2fb47b8c6f6d877b293c
SHA256e150aac75f5a442eefca075cc815e7baa1ade1a4559834e0f643ccc6baceda1f
SHA512b251f959de836c768b7eb35c5f5d7128bd490015da09039f2131fda73b343aa0b586a6f97cd622bf9f57627987c21661b619087b89ccf3c4c5e88add3f5be0be