8e4e70d3235f292a222a1c07f2bea1a30aa54df871aa0c4e57ea6d3301f4a6b1

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 21:21

Target

ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe
Size

128KB
MD5

ec0483abe943a1877d2916bb2cfc3143
SHA1

05a3427fc5714984b27f47e652a0a6634701fe78
SHA256

8e4e70d3235f292a222a1c07f2bea1a30aa54df871aa0c4e57ea6d3301f4a6b1
SHA512

d974765e885a092501a0a5c4688f6d679f2fdbc5a8d342c559e900286db38cbd5406074b349dd60ecb9ebbcb4b260cca39dec2d03e88f83d3797d845dbb699d9
SSDEEP

3072:NInFftYDayoSf9lIQvt7XSY8g+xwbUxjA:KF6ay1l/17d8gpbajA

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2528	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2876	vitrwm.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vitrwm.exe	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vitrwm.exe	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1732	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2528	1732	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2528	1732	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2528	1732	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2528	1732	ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec0483abe943a1877d2916bb2cfc3143_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EC0483~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2528

C:\Windows\SysWOW64\vitrwm.exe
C:\Windows\SysWOW64\vitrwm.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\SysWOW64\vitrwm.exe

Filesize
128KB

MD5
ec0483abe943a1877d2916bb2cfc3143

SHA1
05a3427fc5714984b27f47e652a0a6634701fe78

SHA256
8e4e70d3235f292a222a1c07f2bea1a30aa54df871aa0c4e57ea6d3301f4a6b1

SHA512
d974765e885a092501a0a5c4688f6d679f2fdbc5a8d342c559e900286db38cbd5406074b349dd60ecb9ebbcb4b260cca39dec2d03e88f83d3797d845dbb699d9

Download Submit
memory/2876-4-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download