c313893891fa434363f8851ec514df4bef24a39498206b03d77c8cc7c599ffe8

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe
Size

372KB
MD5

3c3b06000340b4f751c659d93a183a6f
SHA1

1240d336ef9cb15efdc0577c24f4024fd543809b
SHA256

c313893891fa434363f8851ec514df4bef24a39498206b03d77c8cc7c599ffe8
SHA512

e3a5972f5afe5c181e952fa82f6a83d7646ded5c39196a968a0f06dd39213ad1251d34a6ef6d0718f0a4890a1d8638c1e6f20147f8b2bf7b7a66611762011257
SSDEEP

6144:QFJ0xTo2eXessxiW631AFHHHKEVLA3HvozhLY8Oo4bm5Soq9HJkDNp3C7ZmZI/CD:lelxBOxHHDLA3PuhLPOo4yIZ6J5+/CyK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2404	beejdecaid.exe

Loads dropped DLL 5 IoCs

pid	Process
2124	3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	2404	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beejdecaid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2800	wmic.exe
Token: SeSecurityPrivilege	2800	wmic.exe
Token: SeTakeOwnershipPrivilege	2800	wmic.exe
Token: SeLoadDriverPrivilege	2800	wmic.exe
Token: SeSystemProfilePrivilege	2800	wmic.exe
Token: SeSystemtimePrivilege	2800	wmic.exe
Token: SeProfSingleProcessPrivilege	2800	wmic.exe
Token: SeIncBasePriorityPrivilege	2800	wmic.exe
Token: SeCreatePagefilePrivilege	2800	wmic.exe
Token: SeBackupPrivilege	2800	wmic.exe
Token: SeRestorePrivilege	2800	wmic.exe
Token: SeShutdownPrivilege	2800	wmic.exe
Token: SeDebugPrivilege	2800	wmic.exe
Token: SeSystemEnvironmentPrivilege	2800	wmic.exe
Token: SeRemoteShutdownPrivilege	2800	wmic.exe
Token: SeUndockPrivilege	2800	wmic.exe
Token: SeManageVolumePrivilege	2800	wmic.exe
Token: 33	2800	wmic.exe
Token: 34	2800	wmic.exe
Token: 35	2800	wmic.exe
Token: SeIncreaseQuotaPrivilege	2800	wmic.exe
Token: SeSecurityPrivilege	2800	wmic.exe
Token: SeTakeOwnershipPrivilege	2800	wmic.exe
Token: SeLoadDriverPrivilege	2800	wmic.exe
Token: SeSystemProfilePrivilege	2800	wmic.exe
Token: SeSystemtimePrivilege	2800	wmic.exe
Token: SeProfSingleProcessPrivilege	2800	wmic.exe
Token: SeIncBasePriorityPrivilege	2800	wmic.exe
Token: SeCreatePagefilePrivilege	2800	wmic.exe
Token: SeBackupPrivilege	2800	wmic.exe
Token: SeRestorePrivilege	2800	wmic.exe
Token: SeShutdownPrivilege	2800	wmic.exe
Token: SeDebugPrivilege	2800	wmic.exe
Token: SeSystemEnvironmentPrivilege	2800	wmic.exe
Token: SeRemoteShutdownPrivilege	2800	wmic.exe
Token: SeUndockPrivilege	2800	wmic.exe
Token: SeManageVolumePrivilege	2800	wmic.exe
Token: 33	2800	wmic.exe
Token: 34	2800	wmic.exe
Token: 35	2800	wmic.exe
Token: SeIncreaseQuotaPrivilege	2916	wmic.exe
Token: SeSecurityPrivilege	2916	wmic.exe
Token: SeTakeOwnershipPrivilege	2916	wmic.exe
Token: SeLoadDriverPrivilege	2916	wmic.exe
Token: SeSystemProfilePrivilege	2916	wmic.exe
Token: SeSystemtimePrivilege	2916	wmic.exe
Token: SeProfSingleProcessPrivilege	2916	wmic.exe
Token: SeIncBasePriorityPrivilege	2916	wmic.exe
Token: SeCreatePagefilePrivilege	2916	wmic.exe
Token: SeBackupPrivilege	2916	wmic.exe
Token: SeRestorePrivilege	2916	wmic.exe
Token: SeShutdownPrivilege	2916	wmic.exe
Token: SeDebugPrivilege	2916	wmic.exe
Token: SeSystemEnvironmentPrivilege	2916	wmic.exe
Token: SeRemoteShutdownPrivilege	2916	wmic.exe
Token: SeUndockPrivilege	2916	wmic.exe
Token: SeManageVolumePrivilege	2916	wmic.exe
Token: 33	2916	wmic.exe
Token: 34	2916	wmic.exe
Token: 35	2916	wmic.exe
Token: SeIncreaseQuotaPrivilege	2500	wmic.exe
Token: SeSecurityPrivilege	2500	wmic.exe
Token: SeTakeOwnershipPrivilege	2500	wmic.exe
Token: SeLoadDriverPrivilege	2500	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2404	2124	3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2404	2124	3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2404	2124	3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2404	2124	3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2800	2404	beejdecaid.exe	31
PID 2404 wrote to memory of 2800	2404	beejdecaid.exe	31
PID 2404 wrote to memory of 2800	2404	beejdecaid.exe	31
PID 2404 wrote to memory of 2800	2404	beejdecaid.exe	31
PID 2404 wrote to memory of 2916	2404	beejdecaid.exe	34
PID 2404 wrote to memory of 2916	2404	beejdecaid.exe	34
PID 2404 wrote to memory of 2916	2404	beejdecaid.exe	34
PID 2404 wrote to memory of 2916	2404	beejdecaid.exe	34
PID 2404 wrote to memory of 2500	2404	beejdecaid.exe	36
PID 2404 wrote to memory of 2500	2404	beejdecaid.exe	36
PID 2404 wrote to memory of 2500	2404	beejdecaid.exe	36
PID 2404 wrote to memory of 2500	2404	beejdecaid.exe	36
PID 2404 wrote to memory of 2516	2404	beejdecaid.exe	38
PID 2404 wrote to memory of 2516	2404	beejdecaid.exe	38
PID 2404 wrote to memory of 2516	2404	beejdecaid.exe	38
PID 2404 wrote to memory of 2516	2404	beejdecaid.exe	38
PID 2404 wrote to memory of 2728	2404	beejdecaid.exe	40
PID 2404 wrote to memory of 2728	2404	beejdecaid.exe	40
PID 2404 wrote to memory of 2728	2404	beejdecaid.exe	40
PID 2404 wrote to memory of 2728	2404	beejdecaid.exe	40
PID 2404 wrote to memory of 2560	2404	beejdecaid.exe	42
PID 2404 wrote to memory of 2560	2404	beejdecaid.exe	42
PID 2404 wrote to memory of 2560	2404	beejdecaid.exe	42
PID 2404 wrote to memory of 2560	2404	beejdecaid.exe	42

C:\Users\Admin\AppData\Local\Temp\3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c3b06000340b4f751c659d93a183a6f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\beejdecaid.exe
  C:\Users\Admin\AppData\Local\Temp\beejdecaid.exe 9]3]0]5]3]6]7]3]9]9]2 Jk1JPzosLDApLh4mUFU9TUM9OicXLUVCVFJMTERGOzQvFyxERFBOQkE0KTcuMzAbLD1CQTQnHiZNUkpBTzxRVkBCNC85Ky0qGSxKPFBNQlJaUkxFOl9rcmc3LypwbG8rOzxRQipUSk0nOk1HJUdFQ08bLD1FRjpCRzs6SVBIU2phJ2Fiai82MmEtLWonWlgrZjAub0hRLmtGdV9FeUdhJ2dOXjtzam11MEdNPERRLzVHd0RrX29eTipITCQtSz9obXBNLFl1Ty5NbW5Maz5WUTUvcDNqbkhOMj1DWEBAMl9pSUJGZW1JYGZBcSplLGQuFy07Lj0oLhooQSk0KygdLz8wNyYuFyZCKzotLB0pPTI0JC8XLFBNTD5OQEtWTklGVjxAUzYdJkdQRkFVPlFZPlJDODsXLFBNTD5OQEtWTDhKRThCTRksPE9DVlJSRzoedFJJQ3sXLEVTQlk8SjtDR0VCPRssQkhQS1ZASUxXTkJMNjIXJlI/Pk5GVklOXExJSjRldG9tNCgsWFpqYGBrKV5eYWxaKCxlYnQqcW9IdC9DNDpIeXVsT0lUSi1mZms5aDxubTopHXRYbzE4I3Babyk0JG1eci46LC4tLzAkR0BUUzogZjo8Sh4mU004LxooQUooOykyMDM2GihPTEVSQEpFWlQ/RUBGRENASkFCQk9LSTQXLUBQX01SSE1GRDw7a291YB0pS0JLTFBFRk5CXE9MQklWQjhWUzgvGihFQDtDTzoxGyxDTFw7UEw4Skk+XD9HQElQTktCRDhjW2VwXBctO0xXSUlJOkFWQE40LzAzKysqLSUwMSUuMi0dKUk+SThKQ0JMWkZITFE4Q0o0cXJwYhooUUBEQzQuNC82LS4tLi43FyxESlRIRUw4O11LRk1AOisrLCwmMCcuNSU2NCszMSg3IU1N
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81728770215.txt bios get serialnumber
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81728770215.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81728770215.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81728770215.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81728770215.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81728770215.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\beejdecaid.exe

Filesize
635KB

MD5
242e238947c01202953470b25d3469ec

SHA1
12716b90a2f5411201a01f16022c3733070cc0a7

SHA256
89e83a0261d405f350d59e8afe3fe07576717937678ce6869ac1b572b998a411

SHA512
0373a4e9736978a41358d5ad83893daa8a600e40d97a14f4ced888584fbc70bf49be2efc6ecb3bfc1ce0fca45072b376321b44af24cc9af0d0b26b487444495c

Download Submit