b52f77012ba60a701428a473182c2d059f01eec8ef5824567c095e528dbfabb5

Analysis

max time kernel
1s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 01:49

Target

f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe
Size

17KB
MD5

f269171b4ae4b8b9613e39f13734f2bb
SHA1

dc52b8244ff444e51bd8b9007fbd87bb24ceca80
SHA256

b52f77012ba60a701428a473182c2d059f01eec8ef5824567c095e528dbfabb5
SHA512

6b6b308cfa11cbe9b3ab9f1dddb316221a51fdca305747a675c2c3d40eb09a1099c1d60e4cb3d076980179745b1e0ad83a8d4462a03a91cc22bbe6d6e3a2fecb
SSDEEP

384:ajb2KK8qY5m2en32YKzWk0J0Ti4asQDjP7:Ow8Dne32YKzWkOKiGCP

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1576	WinHelp32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1968-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x00070000000233e4-5.dat	upx
behavioral2/memory/1576-9-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHelp32.exe	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WinHelp32.exe	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1968	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1576	1968	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe	83
PID 1968 wrote to memory of 1576	1968	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe	83
PID 1968 wrote to memory of 1576	1968	f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f269171b4ae4b8b9613e39f13734f2bb_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WinHelp32.exe
  "C:\Windows\system32\WinHelp32.exe"
  2⤵
  - Executes dropped EXE
  PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\WINHEL~1.EXE > nul
    3⤵
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\F26917~1.EXE > nul
  2⤵
  PID:3988

C:\Windows\SysWOW64\WinHelp32.exe

Filesize
17KB

MD5
f269171b4ae4b8b9613e39f13734f2bb

SHA1
dc52b8244ff444e51bd8b9007fbd87bb24ceca80

SHA256
b52f77012ba60a701428a473182c2d059f01eec8ef5824567c095e528dbfabb5

SHA512
6b6b308cfa11cbe9b3ab9f1dddb316221a51fdca305747a675c2c3d40eb09a1099c1d60e4cb3d076980179745b1e0ad83a8d4462a03a91cc22bbe6d6e3a2fecb

Download Submit
C:\Windows\SysWOW64\drivers\PCIDump.sys

Filesize
4KB

MD5
d058dd1757e857d2cf1afcadce95a521

SHA1
3d5563ce8e7a11110d238b25711a176a63bfb703

SHA256
a0cd51ff93d087654b5ceccc279df8eb5e9783a530a3bca83a06c7f82025885d

SHA512
748937d6ae01ddbe97470754b73563c04e492d7980a8e0bbb9ed7838e85c8cff912d087204325664c3051aeba15606d23b9b507b211a6369e7ecc7bda175da44

Download Submit
memory/1576-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1968-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download