Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 17:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52caf574e4211d14a167e9b1c500df47_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
52caf574e4211d14a167e9b1c500df47_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
beeheebchc.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
beeheebchc.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
beeheebchc.exe
-
Size
563KB
-
MD5
5618deb16dcfd81c10ee60af4ddb72ee
-
SHA1
feef617f04364b7f2723611d959f6b7d80b36fd9
-
SHA256
a471054ed41d3794b3f2222ab849f3f192a63e26560068c736051454a895b9c4
-
SHA512
75d656aedd88061ae05f3f507184fd7ae8f87dd794704b27d4b1a10871fdda35a3bacd56c20b63f9d375ddfa1d19a0587fd4028d224aa0ea26eea36019f8aae2
-
SSDEEP
12288:FCsn5OejVsQwDgLMUB5vIXbyVxbHFoVlbOzKBztyAH4W:FCyPB+D8MUB5vIXbyVxbHFKl62Bz4AHj
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1952 1656 WerFault.exe 27 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beeheebchc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1972 wmic.exe Token: SeSecurityPrivilege 1972 wmic.exe Token: SeTakeOwnershipPrivilege 1972 wmic.exe Token: SeLoadDriverPrivilege 1972 wmic.exe Token: SeSystemProfilePrivilege 1972 wmic.exe Token: SeSystemtimePrivilege 1972 wmic.exe Token: SeProfSingleProcessPrivilege 1972 wmic.exe Token: SeIncBasePriorityPrivilege 1972 wmic.exe Token: SeCreatePagefilePrivilege 1972 wmic.exe Token: SeBackupPrivilege 1972 wmic.exe Token: SeRestorePrivilege 1972 wmic.exe Token: SeShutdownPrivilege 1972 wmic.exe Token: SeDebugPrivilege 1972 wmic.exe Token: SeSystemEnvironmentPrivilege 1972 wmic.exe Token: SeRemoteShutdownPrivilege 1972 wmic.exe Token: SeUndockPrivilege 1972 wmic.exe Token: SeManageVolumePrivilege 1972 wmic.exe Token: 33 1972 wmic.exe Token: 34 1972 wmic.exe Token: 35 1972 wmic.exe Token: SeIncreaseQuotaPrivilege 1972 wmic.exe Token: SeSecurityPrivilege 1972 wmic.exe Token: SeTakeOwnershipPrivilege 1972 wmic.exe Token: SeLoadDriverPrivilege 1972 wmic.exe Token: SeSystemProfilePrivilege 1972 wmic.exe Token: SeSystemtimePrivilege 1972 wmic.exe Token: SeProfSingleProcessPrivilege 1972 wmic.exe Token: SeIncBasePriorityPrivilege 1972 wmic.exe Token: SeCreatePagefilePrivilege 1972 wmic.exe Token: SeBackupPrivilege 1972 wmic.exe Token: SeRestorePrivilege 1972 wmic.exe Token: SeShutdownPrivilege 1972 wmic.exe Token: SeDebugPrivilege 1972 wmic.exe Token: SeSystemEnvironmentPrivilege 1972 wmic.exe Token: SeRemoteShutdownPrivilege 1972 wmic.exe Token: SeUndockPrivilege 1972 wmic.exe Token: SeManageVolumePrivilege 1972 wmic.exe Token: 33 1972 wmic.exe Token: 34 1972 wmic.exe Token: 35 1972 wmic.exe Token: SeIncreaseQuotaPrivilege 2444 wmic.exe Token: SeSecurityPrivilege 2444 wmic.exe Token: SeTakeOwnershipPrivilege 2444 wmic.exe Token: SeLoadDriverPrivilege 2444 wmic.exe Token: SeSystemProfilePrivilege 2444 wmic.exe Token: SeSystemtimePrivilege 2444 wmic.exe Token: SeProfSingleProcessPrivilege 2444 wmic.exe Token: SeIncBasePriorityPrivilege 2444 wmic.exe Token: SeCreatePagefilePrivilege 2444 wmic.exe Token: SeBackupPrivilege 2444 wmic.exe Token: SeRestorePrivilege 2444 wmic.exe Token: SeShutdownPrivilege 2444 wmic.exe Token: SeDebugPrivilege 2444 wmic.exe Token: SeSystemEnvironmentPrivilege 2444 wmic.exe Token: SeRemoteShutdownPrivilege 2444 wmic.exe Token: SeUndockPrivilege 2444 wmic.exe Token: SeManageVolumePrivilege 2444 wmic.exe Token: 33 2444 wmic.exe Token: 34 2444 wmic.exe Token: 35 2444 wmic.exe Token: SeIncreaseQuotaPrivilege 2440 wmic.exe Token: SeSecurityPrivilege 2440 wmic.exe Token: SeTakeOwnershipPrivilege 2440 wmic.exe Token: SeLoadDriverPrivilege 2440 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1972 1656 beeheebchc.exe 28 PID 1656 wrote to memory of 1972 1656 beeheebchc.exe 28 PID 1656 wrote to memory of 1972 1656 beeheebchc.exe 28 PID 1656 wrote to memory of 1972 1656 beeheebchc.exe 28 PID 1656 wrote to memory of 2444 1656 beeheebchc.exe 31 PID 1656 wrote to memory of 2444 1656 beeheebchc.exe 31 PID 1656 wrote to memory of 2444 1656 beeheebchc.exe 31 PID 1656 wrote to memory of 2444 1656 beeheebchc.exe 31 PID 1656 wrote to memory of 2440 1656 beeheebchc.exe 33 PID 1656 wrote to memory of 2440 1656 beeheebchc.exe 33 PID 1656 wrote to memory of 2440 1656 beeheebchc.exe 33 PID 1656 wrote to memory of 2440 1656 beeheebchc.exe 33 PID 1656 wrote to memory of 2712 1656 beeheebchc.exe 35 PID 1656 wrote to memory of 2712 1656 beeheebchc.exe 35 PID 1656 wrote to memory of 2712 1656 beeheebchc.exe 35 PID 1656 wrote to memory of 2712 1656 beeheebchc.exe 35 PID 1656 wrote to memory of 2784 1656 beeheebchc.exe 37 PID 1656 wrote to memory of 2784 1656 beeheebchc.exe 37 PID 1656 wrote to memory of 2784 1656 beeheebchc.exe 37 PID 1656 wrote to memory of 2784 1656 beeheebchc.exe 37 PID 1656 wrote to memory of 1952 1656 beeheebchc.exe 39 PID 1656 wrote to memory of 1952 1656 beeheebchc.exe 39 PID 1656 wrote to memory of 1952 1656 beeheebchc.exe 39 PID 1656 wrote to memory of 1952 1656 beeheebchc.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\beeheebchc.exe"C:\Users\Admin\AppData\Local\Temp\beeheebchc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81729185139.txt bios get serialnumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81729185139.txt bios get version2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81729185139.txt bios get version2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81729185139.txt bios get version2⤵
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81729185139.txt bios get version2⤵
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 3722⤵
- Program crash
PID:1952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51