Analysis
-
max time kernel
101s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 10:44
Behavioral task
behavioral1
Sample
eb22dd8e4b78ddd44ceb9336e556ebd7_JaffaCakes118.msi
Resource
win7-20240729-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb22dd8e4b78ddd44ceb9336e556ebd7_JaffaCakes118.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
eb22dd8e4b78ddd44ceb9336e556ebd7_JaffaCakes118.msi
-
Size
996KB
-
MD5
eb22dd8e4b78ddd44ceb9336e556ebd7
-
SHA1
c18c3f48bed890333ab98ae83241003db6b95c73
-
SHA256
a38477583f2c2fd9b07c6c5ba26473893bfa3ff638abf760d933902eadcdcbc6
-
SHA512
7ee234aa221f3bdd0095215eba0ed4666d7a1bd98fcf52eb7e3ce0f756d7ae3440ebf6c2b2626f2b519fc2374901ea6da3c540a501a61faa73d8d53fa3973b28
-
SSDEEP
24576:Y7aBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:Y78lrXVVdWX59GUrSLzeaVtFU
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f780474.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4A2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI59E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5ED.tmp msiexec.exe File created C:\Windows\Installer\f780477.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI784.tmp msiexec.exe File opened for modification C:\Windows\Installer\f780474.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI54F.tmp msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 2860 MsiExec.exe 2860 MsiExec.exe 2860 MsiExec.exe 2860 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2348 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 msiexec.exe 3036 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2348 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2348 msiexec.exe Token: SeIncreaseQuotaPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeSecurityPrivilege 3036 msiexec.exe Token: SeCreateTokenPrivilege 2348 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2348 msiexec.exe Token: SeLockMemoryPrivilege 2348 msiexec.exe Token: SeIncreaseQuotaPrivilege 2348 msiexec.exe Token: SeMachineAccountPrivilege 2348 msiexec.exe Token: SeTcbPrivilege 2348 msiexec.exe Token: SeSecurityPrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeLoadDriverPrivilege 2348 msiexec.exe Token: SeSystemProfilePrivilege 2348 msiexec.exe Token: SeSystemtimePrivilege 2348 msiexec.exe Token: SeProfSingleProcessPrivilege 2348 msiexec.exe Token: SeIncBasePriorityPrivilege 2348 msiexec.exe Token: SeCreatePagefilePrivilege 2348 msiexec.exe Token: SeCreatePermanentPrivilege 2348 msiexec.exe Token: SeBackupPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeShutdownPrivilege 2348 msiexec.exe Token: SeDebugPrivilege 2348 msiexec.exe Token: SeAuditPrivilege 2348 msiexec.exe Token: SeSystemEnvironmentPrivilege 2348 msiexec.exe Token: SeChangeNotifyPrivilege 2348 msiexec.exe Token: SeRemoteShutdownPrivilege 2348 msiexec.exe Token: SeUndockPrivilege 2348 msiexec.exe Token: SeSyncAgentPrivilege 2348 msiexec.exe Token: SeEnableDelegationPrivilege 2348 msiexec.exe Token: SeManageVolumePrivilege 2348 msiexec.exe Token: SeImpersonatePrivilege 2348 msiexec.exe Token: SeCreateGlobalPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2860 3036 msiexec.exe 30 PID 3036 wrote to memory of 2860 3036 msiexec.exe 30 PID 3036 wrote to memory of 2860 3036 msiexec.exe 30 PID 3036 wrote to memory of 2860 3036 msiexec.exe 30 PID 3036 wrote to memory of 2860 3036 msiexec.exe 30 PID 3036 wrote to memory of 2860 3036 msiexec.exe 30 PID 3036 wrote to memory of 2860 3036 msiexec.exe 30
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\eb22dd8e4b78ddd44ceb9336e556ebd7_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2348
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F31712DC9F5385547D43CAA3DCB285D92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
537KB
MD5d7ec04b009302b83da506b9c63ca775c
SHA16fa9ea09b71531754b4cd05814a91032229834c0
SHA25600c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4
SHA512171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c