Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 09:10
Behavioral task
behavioral1
Sample
20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe
-
Size
830KB
-
MD5
20bbd1360c722c9875c13614dfcd4a75
-
SHA1
6a37a82c17b79a99fee8de9b915b923177ca2eae
-
SHA256
bd22ac08d62202ab36e12bda39135d68711331a2d9bcc9e0b5579a30bb10db9f
-
SHA512
672e4e212e3dbc12cdcc5f97a1d2b41e3ad340c55a9114be37d21e937da8bc8add2a26b90513683408183aa4394c131f9e1b24ec3e4bcf07dd280a158d208e81
-
SSDEEP
24576:qwVMY2cvAZjtQmwCDZekassQYV5h7Mlp:qeMY2cYgXCDassQW5h7Mf
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SERVER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 388 PERX.EXE 2576 SERVER.EXE -
Loads dropped DLL 4 IoCs
pid Process 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/628-0-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/files/0x0007000000012118-4.dat upx behavioral1/memory/628-13-0x00000000037F0000-0x00000000038A5000-memory.dmp upx behavioral1/files/0x000800000001686c-24.dat upx behavioral1/memory/2576-25-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-22-0x0000000003800000-0x00000000038E5000-memory.dmp upx behavioral1/memory/388-15-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/628-26-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/388-28-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/628-29-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-32-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/2576-31-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/388-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/628-33-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-35-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-36-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-38-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-39-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-41-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-42-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-44-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-45-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-47-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-48-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-50-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-51-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-53-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-54-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-57-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-59-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-60-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-62-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-63-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-65-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-66-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-68-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral1/memory/628-69-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral1/memory/2576-71-0x0000000000400000-0x00000000004E5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PERX.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SERVER.EXE -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SERVER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SERVER.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SERVER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SERVER.EXE -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier SERVER.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE 388 PERX.EXE -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSecurityPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeLoadDriverPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSystemProfilePrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSystemtimePrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeBackupPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeRestorePrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeShutdownPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeDebugPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeUndockPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeManageVolumePrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeImpersonatePrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 33 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 34 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 35 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2576 SERVER.EXE Token: SeSecurityPrivilege 2576 SERVER.EXE Token: SeTakeOwnershipPrivilege 2576 SERVER.EXE Token: SeLoadDriverPrivilege 2576 SERVER.EXE Token: SeSystemProfilePrivilege 2576 SERVER.EXE Token: SeSystemtimePrivilege 2576 SERVER.EXE Token: SeProfSingleProcessPrivilege 2576 SERVER.EXE Token: SeIncBasePriorityPrivilege 2576 SERVER.EXE Token: SeCreatePagefilePrivilege 2576 SERVER.EXE Token: SeBackupPrivilege 2576 SERVER.EXE Token: SeRestorePrivilege 2576 SERVER.EXE Token: SeShutdownPrivilege 2576 SERVER.EXE Token: SeDebugPrivilege 2576 SERVER.EXE Token: SeSystemEnvironmentPrivilege 2576 SERVER.EXE Token: SeChangeNotifyPrivilege 2576 SERVER.EXE Token: SeRemoteShutdownPrivilege 2576 SERVER.EXE Token: SeUndockPrivilege 2576 SERVER.EXE Token: SeManageVolumePrivilege 2576 SERVER.EXE Token: SeImpersonatePrivilege 2576 SERVER.EXE Token: SeCreateGlobalPrivilege 2576 SERVER.EXE Token: 33 2576 SERVER.EXE Token: 34 2576 SERVER.EXE Token: 35 2576 SERVER.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 628 wrote to memory of 388 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 28 PID 628 wrote to memory of 388 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 28 PID 628 wrote to memory of 388 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 28 PID 628 wrote to memory of 388 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 28 PID 628 wrote to memory of 2576 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 29 PID 628 wrote to memory of 2576 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 29 PID 628 wrote to memory of 2576 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 29 PID 628 wrote to memory of 2576 628 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\PERX.EXE"C:\Users\Admin\AppData\Local\Temp\PERX.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:388
-
-
C:\Users\Admin\AppData\Local\Temp\SERVER.EXE"C:\Users\Admin\AppData\Local\Temp\SERVER.EXE"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD5313a7ff866055ca1434ebc65f3fc1130
SHA1c2558051b179df53b198f736e20407dd9b1d429f
SHA256341f9fcb0845fbccd57e12d555696644e4a32b0ccdf00d6a825bc8fb2419c94d
SHA512a68ed855ab64cae35f9eb62846cc164d2b9ef35764515ffa8a001d397dcaa9b56d395d48a812b1453ee1eba4d3c537c5909860d1746f64ee2587e8a600862449
-
Filesize
262KB
MD5e974a7ed7fa0c096aa1f59ae6d8cce72
SHA124b215e712fa745ac94d033ee7c5a556a5df0dab
SHA256d042a6add7b1547e5165d0c0c0f0eb21ee778b44c27e0a2bbce9f02b79156c0b
SHA512156cfa7b252d8737a4d3fdc3f8095353051d7f15e1293d6c1213de36ea44d526fd94e75765b3a1f75ed83f9b02dd4329b9eab466e9188fea107e622d0c1d6ba4