0e52c56d964fadf5e41e444728d44cc66d7318a3a03414729a03e5099887967c

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe
Size

170KB
MD5

e99bbacb64f079e518f30c1d6e49987f
SHA1

4d3199f46b19a90a8268414147c67029019baf78
SHA256

0e52c56d964fadf5e41e444728d44cc66d7318a3a03414729a03e5099887967c
SHA512

d4d59cb81f299f192a7a4b180c2494107571eb13e5ba7933b062d25c91e96c26afcd0f5c9a0adadee14ecce6d456e5df1a103f10f56aa8dec49bb888b026ae02
SSDEEP

3072:IyxHn9zcAw+XVZVaBOR5OE1EM2jASY1atZgn37zpnop2WtXvs3R:5h2yVZgy92NgvpnoJtEh

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\userinit.exe	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe
Token: SeDebugPrivilege	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57
PID 2004 wrote to memory of 3408	2004	e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408
- C:\Users\Admin\AppData\Local\Temp\e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\e99bbacb64f079e518f30c1d6e49987f_JaffaCakes118.dll

Filesize
114KB

MD5
5290a642a22f6607e0a4d4abe9320936

SHA1
fb8a113bafb16939ecd33d85b75d83222cc4810d

SHA256
fce7b0bf841f3b82323492ddc72daa97a4b35dfea3c6947f29a8c47259f982ed

SHA512
9092b1f5cc2295dcb8c267746bf574ef51ba62910a07fe20e9b1dbeb44336dbe841b215f959d1ece2aabaddc57e128e095f9a2eb3ba1d38ecf01b46acce92ead

Download Submit
memory/2004-11-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/2004-14-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/2004-2-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2004-8-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/2004-5-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2004-10-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2004-7-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2004-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2004-1-0x0000000000A30000-0x0000000000A6A000-memory.dmp

Filesize
232KB

Download
memory/2004-13-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2004-12-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/2004-17-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/2004-18-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/2004-16-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/2004-19-0x0000000023150000-0x0000000023171000-memory.dmp

Filesize
132KB

Download
memory/2004-26-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2004-27-0x0000000013140000-0x0000000013161000-memory.dmp

Filesize
132KB

Download
memory/2004-28-0x0000000000A30000-0x0000000000A6A000-memory.dmp

Filesize
232KB

Download