8a122086e312a779dc1da0f03628211d840f1e993d7165189832976fc0607e21

General

Target

e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe
Size

550KB
MD5

e97c5d0dbf067f09f57fc1fcf6fa1774
SHA1

3052c6a5e7c7e2f89f7b6f2b319bb40a44c4252d
SHA256

8a122086e312a779dc1da0f03628211d840f1e993d7165189832976fc0607e21
SHA512

ab752feb9a957c76439c8f401ec857b0d5ab8992086cadb7b01ddfc26e5251ee056d45914151b44b3186d9c5216083fd51293f2f2f7e32644483d25f4fbdfe7a
SSDEEP

12288:l8zSpBj32LYJyfpVEiDit1c2obY7X2IT2zB:1pBQUQjGJocT2MwB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3116	Hacker.com.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe
Token: SeDebugPrivilege	3116	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3116	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 388	464	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe	93
PID 464 wrote to memory of 388	464	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe	93
PID 464 wrote to memory of 388	464	e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e97c5d0dbf067f09f57fc1fcf6fa1774_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:388

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hacker.com.cn.exe

Filesize
550KB

MD5
e97c5d0dbf067f09f57fc1fcf6fa1774

SHA1
3052c6a5e7c7e2f89f7b6f2b319bb40a44c4252d

SHA256
8a122086e312a779dc1da0f03628211d840f1e993d7165189832976fc0607e21

SHA512
ab752feb9a957c76439c8f401ec857b0d5ab8992086cadb7b01ddfc26e5251ee056d45914151b44b3186d9c5216083fd51293f2f2f7e32644483d25f4fbdfe7a

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
0254ace53045ce15805ca78966ad1086

SHA1
80c80c43f6427e6dbc877877f70834bba3bd951a

SHA256
625f5aa34ae01755737f1a31eaf8f111809de14002d1f9ed1a5a77a64f1103b3

SHA512
26a00429dad473c2ae3d58f516cc382d6e79a0d1671c903577bf9a156546a6c3478d9c7f49d958457f5d84fa55238a1e1fc82770d91cf937b2f7895a68ca7fce

Download Submit
memory/464-18-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/464-3-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/464-4-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/464-5-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/464-6-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/464-7-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/464-8-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/464-9-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/464-10-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/464-11-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/464-12-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/464-13-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/464-14-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/464-15-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/464-16-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/464-17-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/464-19-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/464-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/464-1-0x00000000022A0000-0x00000000022F0000-memory.dmp

Filesize
320KB

Download
memory/464-23-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/464-24-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/464-25-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/464-26-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/464-27-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/464-28-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/464-29-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/464-2-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/464-39-0x00000000022A0000-0x00000000022F0000-memory.dmp

Filesize
320KB

Download
memory/464-20-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/464-38-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/3116-34-0x0000000000CE0000-0x0000000000D30000-memory.dmp

Filesize
320KB

Download
memory/3116-35-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/3116-32-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/3116-33-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/3116-41-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/3116-42-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing