Analysis
-
max time kernel
148s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe
-
Size
785KB
-
MD5
1a5e5da547bc663758935c6645f14bce
-
SHA1
ee3e2961565336ef8636a772dfe3ad58ff34ceff
-
SHA256
ac6c4b93f07e35bd7520b13a957f0284510a778bb10f03b2a7d9909201131ec9
-
SHA512
67a00f8cf11f95b5c80ee9249a3cad7feead7ec1372c14a6a5661d9bf2a7523d816c8a72032bb4aad79efc1acbf3b5a8d15f31a760bddcaf8ad0c66d3f7b3fe0
-
SSDEEP
12288:4l1S8FkVsuuQKFEG2wSywBNNYBO4V1uaiK/lGRgOUqmq9kR6lhKX4aVTp6CxSE5b:+kC53EGiSQ/K/cRgOnmq9g6v6pfh5b
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSecurityPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSystemtimePrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeBackupPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeRestorePrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeShutdownPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeDebugPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeUndockPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeManageVolumePrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeImpersonatePrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 33 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 34 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 35 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe Token: 36 3232 1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a5e5da547bc663758935c6645f14bce_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3232-1-0x0000000000800000-0x0000000000860000-memory.dmpFilesize
384KB
-
memory/3232-0-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-26-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-2-0x0000000002190000-0x0000000002191000-memory.dmpFilesize
4KB
-
memory/3232-25-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-34-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-33-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-32-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-31-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-30-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-29-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-28-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-27-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-24-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-23-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-22-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-21-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-20-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-19-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-18-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-17-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-16-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-15-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-14-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-13-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-12-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-11-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-10-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-9-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-8-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-7-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/3232-6-0x0000000002170000-0x0000000002171000-memory.dmpFilesize
4KB
-
memory/3232-5-0x00000000021B0000-0x00000000021B1000-memory.dmpFilesize
4KB
-
memory/3232-4-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/3232-36-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-35-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-3-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/3232-37-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-38-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-64-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-74-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-73-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-72-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-71-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-70-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-69-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-68-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-67-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-65-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-63-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-62-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-61-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-60-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-59-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-58-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-57-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-56-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-55-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-54-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-53-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-52-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-51-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-50-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-49-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-48-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-47-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-46-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-45-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-44-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-43-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-42-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-41-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-40-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-39-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-66-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-75-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-76-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-77-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-78-0x0000000000800000-0x0000000000860000-memory.dmpFilesize
384KB
-
memory/3232-79-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-84-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-91-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-97-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-96-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-95-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-94-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-93-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-92-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-90-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-89-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-88-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-87-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-86-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-85-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-83-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-82-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-81-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-80-0x00000000032C0000-0x00000000032DB000-memory.dmpFilesize
108KB
-
memory/3232-135-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-136-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-137-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-138-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-139-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-140-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-141-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-142-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-143-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-144-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-145-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB
-
memory/3232-146-0x0000000000400000-0x000000000053D000-memory.dmpFilesize
1.2MB