Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe
-
Size
758KB
-
MD5
14f834063c40133fdefcdbd19a7812c8
-
SHA1
1160b1bf5c5ad7da930e61cb551567d46c776978
-
SHA256
ca49d40f50afa04de7070c16f4c85a92eeed5e5dcbb03b59d0c416f2b5fa2d92
-
SHA512
883565109505dc171247f8dcfd1d98b9043308055e8bd1be3c2efee8dee90fdd32a85be476259f29047ac8bf9f0334bfef96c79cd7b10a40c010ebfbbe99bcf1
-
SSDEEP
12288:yzSF3nFo/1NATB7Ilv18BqIWioYcpVVpEeiO0kDjy6eindvQr:zpnqfATtIEiCGpxioS2Qr
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exedescription pid process target process PID 2220 set thread context of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier vbc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4748 vbc.exe Token: SeSecurityPrivilege 4748 vbc.exe Token: SeTakeOwnershipPrivilege 4748 vbc.exe Token: SeLoadDriverPrivilege 4748 vbc.exe Token: SeSystemProfilePrivilege 4748 vbc.exe Token: SeSystemtimePrivilege 4748 vbc.exe Token: SeProfSingleProcessPrivilege 4748 vbc.exe Token: SeIncBasePriorityPrivilege 4748 vbc.exe Token: SeCreatePagefilePrivilege 4748 vbc.exe Token: SeBackupPrivilege 4748 vbc.exe Token: SeRestorePrivilege 4748 vbc.exe Token: SeShutdownPrivilege 4748 vbc.exe Token: SeDebugPrivilege 4748 vbc.exe Token: SeSystemEnvironmentPrivilege 4748 vbc.exe Token: SeChangeNotifyPrivilege 4748 vbc.exe Token: SeRemoteShutdownPrivilege 4748 vbc.exe Token: SeUndockPrivilege 4748 vbc.exe Token: SeManageVolumePrivilege 4748 vbc.exe Token: SeImpersonatePrivilege 4748 vbc.exe Token: SeCreateGlobalPrivilege 4748 vbc.exe Token: 33 4748 vbc.exe Token: 34 4748 vbc.exe Token: 35 4748 vbc.exe Token: 36 4748 vbc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exedescription pid process target process PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe PID 2220 wrote to memory of 4748 2220 14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2220-10-0x0000000074690000-0x0000000074C41000-memory.dmpFilesize
5.7MB
-
memory/2220-1-0x0000000074690000-0x0000000074C41000-memory.dmpFilesize
5.7MB
-
memory/2220-2-0x0000000074690000-0x0000000074C41000-memory.dmpFilesize
5.7MB
-
memory/2220-0-0x0000000074692000-0x0000000074693000-memory.dmpFilesize
4KB
-
memory/4748-13-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-16-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-8-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-4-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-11-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-9-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-12-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-7-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-3-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-14-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-15-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-6-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-17-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-18-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-19-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-20-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-21-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-22-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-23-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-24-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-25-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/4748-26-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB