058b8da6127e6d3e2ce64d7a29fcd12290e4361f4d5c7c636dff5d457b126e2d

Analysis

max time kernel
92s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 12:22

Target
ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe
Size 74KB
Sample240411-pj49caee9t
SHA256 058b8da6127e6d3e2ce64d7a29fcd12290e4361f4d5c7c636dff5d457b126e2d
MD5 ed69a440373fb0b9bd7cf594d0c72ff2
SHA1 0b204676feafcbc209ea4ab744ca4434c1da722b
SHA512 06ec9c60e35374e73bcfa0fbd1f63f365da63dc6c8bba1f3585d233332319b5623d1e7db6276a6e8fc9718fbb0e2979646c5c141417da4ebabdde072c70a1b91
SSDEEP 768:JwX0OekIYUgDYED27XCFRw7WtNDKp4niuKdbzTb5dPOlnCVKCLaZVhObCDxoQ:JkjIYVbD2zCDw7WxnsRtSnaKlxxo
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rsaauto.bak	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\systom32\svchost.exe	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe
File opened for modification	C:\Windows\systom32\	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe
File created	C:\Windows\systom32\svchost.exe	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	1588	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4480	1588	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe	85
PID 1588 wrote to memory of 4480	1588	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe	85
PID 1588 wrote to memory of 4480	1588	ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed69a440373fb0b9bd7cf594d0c72ff2_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:4480

afc9fe2f418b00a0.bat

Path C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat
Size 2KB
SHA256 22e718a8b8f843852c1ff906508eef3fc3b20b919e2af3b50b8a2ac2f0c4e7b0
MD5 5d439f44d4945eea2cd1a666076fb2c8
SHA1 8450d1bc51a0c51934730e70b2383ea7e277fbe7
SHA512 96e39193c5c4fc32893eb7f1437006a4c2466b39ff205c9dcbda0d5c6dd3f62ae0c0bf6e0e13a655117defd62285e1b5260df074c9f2a4d48b0ff76575972107
MD5 SHA1 SHA512

Submit Download

memory/1588-0-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1588-8-0x0000000000400000-0x0000000000416000-memory.dmp

Download