Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2025, 20:18
Behavioral task
behavioral1
Sample
JaffaCakes118_ed3edf8fdb2cd2f027127f4fb1fe7019.msi
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_ed3edf8fdb2cd2f027127f4fb1fe7019.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_ed3edf8fdb2cd2f027127f4fb1fe7019.msi
-
Size
264KB
-
MD5
ed3edf8fdb2cd2f027127f4fb1fe7019
-
SHA1
e876622ade868b5c8461b80a9b8e4961e9427b2e
-
SHA256
ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3
-
SHA512
051d9ff3bc18233ee3174113b566a1bbd653588b9070563f9627c51315cd0e39bc6151a92f5df91cc8c809cd021ae79ab43ac0b88013930f7da7864c68a10d42
-
SSDEEP
3072:XmWqcL903DaYlA8wgz88ereWn/7w05g0HMcB3RUN46ILJ9+ZB5yOanfN:XmJ3DaYlAN8er1nzTqrYN
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 11 408 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF86A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFA4F.tmp msiexec.exe File created C:\Windows\Installer\e57f80c.msi msiexec.exe File opened for modification C:\Windows\Installer\e57f80c.msi msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 408 MsiExec.exe 408 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4412 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 4412 msiexec.exe Token: SeIncreaseQuotaPrivilege 4412 msiexec.exe Token: SeSecurityPrivilege 776 msiexec.exe Token: SeCreateTokenPrivilege 4412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4412 msiexec.exe Token: SeLockMemoryPrivilege 4412 msiexec.exe Token: SeIncreaseQuotaPrivilege 4412 msiexec.exe Token: SeMachineAccountPrivilege 4412 msiexec.exe Token: SeTcbPrivilege 4412 msiexec.exe Token: SeSecurityPrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeLoadDriverPrivilege 4412 msiexec.exe Token: SeSystemProfilePrivilege 4412 msiexec.exe Token: SeSystemtimePrivilege 4412 msiexec.exe Token: SeProfSingleProcessPrivilege 4412 msiexec.exe Token: SeIncBasePriorityPrivilege 4412 msiexec.exe Token: SeCreatePagefilePrivilege 4412 msiexec.exe Token: SeCreatePermanentPrivilege 4412 msiexec.exe Token: SeBackupPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeShutdownPrivilege 4412 msiexec.exe Token: SeDebugPrivilege 4412 msiexec.exe Token: SeAuditPrivilege 4412 msiexec.exe Token: SeSystemEnvironmentPrivilege 4412 msiexec.exe Token: SeChangeNotifyPrivilege 4412 msiexec.exe Token: SeRemoteShutdownPrivilege 4412 msiexec.exe Token: SeUndockPrivilege 4412 msiexec.exe Token: SeSyncAgentPrivilege 4412 msiexec.exe Token: SeEnableDelegationPrivilege 4412 msiexec.exe Token: SeManageVolumePrivilege 4412 msiexec.exe Token: SeImpersonatePrivilege 4412 msiexec.exe Token: SeCreateGlobalPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 776 msiexec.exe Token: SeTakeOwnershipPrivilege 776 msiexec.exe Token: SeRestorePrivilege 776 msiexec.exe Token: SeTakeOwnershipPrivilege 776 msiexec.exe Token: SeRestorePrivilege 776 msiexec.exe Token: SeTakeOwnershipPrivilege 776 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4412 msiexec.exe 4412 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 776 wrote to memory of 408 776 msiexec.exe 85 PID 776 wrote to memory of 408 776 msiexec.exe 85 PID 776 wrote to memory of 408 776 msiexec.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed3edf8fdb2cd2f027127f4fb1fe7019.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4412
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AFC5C8260D7117A5FBFE020FC461DA6C2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b