Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe
-
Size
785KB
-
MD5
1a5e5da547bc663758935c6645f14bce
-
SHA1
ee3e2961565336ef8636a772dfe3ad58ff34ceff
-
SHA256
ac6c4b93f07e35bd7520b13a957f0284510a778bb10f03b2a7d9909201131ec9
-
SHA512
67a00f8cf11f95b5c80ee9249a3cad7feead7ec1372c14a6a5661d9bf2a7523d816c8a72032bb4aad79efc1acbf3b5a8d15f31a760bddcaf8ad0c66d3f7b3fe0
-
SSDEEP
12288:4l1S8FkVsuuQKFEG2wSywBNNYBO4V1uaiK/lGRgOUqmq9kR6lhKX4aVTp6CxSE5b:+kC53EGiSQ/K/cRgOnmq9g6v6pfh5b
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSecurityPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSystemtimePrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeBackupPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeRestorePrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeShutdownPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeDebugPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeUndockPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeManageVolumePrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeImpersonatePrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 33 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 34 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 35 2924 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2924-0-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-35-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-74-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-73-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-72-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-71-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-70-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-69-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-68-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-67-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-66-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-65-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-64-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-63-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-62-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-61-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-60-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-59-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-58-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-57-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-56-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-55-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-54-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-53-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-52-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-51-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-50-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-49-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-48-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-47-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-46-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-45-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-44-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-43-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-42-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-41-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-40-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-39-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-38-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-37-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-36-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-34-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-33-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-32-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-31-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-30-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-29-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-28-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-27-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-26-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-25-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-24-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-23-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-22-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-21-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-20-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-19-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-18-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-17-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-16-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-15-0x0000000001F40000-0x0000000001F41000-memory.dmpFilesize
4KB
-
memory/2924-14-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-13-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-12-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-11-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-10-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-9-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-8-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-7-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-6-0x0000000001FA0000-0x0000000001FA1000-memory.dmpFilesize
4KB
-
memory/2924-5-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2924-4-0x0000000001F60000-0x0000000001F61000-memory.dmpFilesize
4KB
-
memory/2924-3-0x0000000001F90000-0x0000000001F91000-memory.dmpFilesize
4KB
-
memory/2924-2-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2924-1-0x0000000000310000-0x0000000000370000-memory.dmpFilesize
384KB
-
memory/2924-75-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-76-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-77-0x0000000000310000-0x0000000000370000-memory.dmpFilesize
384KB
-
memory/2924-79-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2924-78-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/2924-80-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-81-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-82-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-83-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-84-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-85-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-86-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-87-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-88-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-89-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-90-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-91-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/2924-92-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB