cd58b7466e29552f44ac414b97f0c162f73788f213e4dee9f759fac36e5d35f8

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 02:44

Target

f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe
Size

22KB
MD5

f28109ced0985f33f19295314c3a245a
SHA1

47613fdfd9b6eb74308ecf8ff3e9708fbbe64bed
SHA256

cd58b7466e29552f44ac414b97f0c162f73788f213e4dee9f759fac36e5d35f8
SHA512

52428a2693749adbb5611668a76f3ab639990398f56a29033c059a24b34d42599d6ff62626618a1d31239761d687d3fab2c54fd936a032079c3a97b220b5cc41
SSDEEP

384:Iq0+g2SRK6DeQ80HNb5zNcBNn1pBQTeZeEQ8UVMF1hqXiLaQCZ2lg:D1WHNbRNun3BQThCf/8iWQG2l

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1620	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_aa.bat	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1620	2252	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	31
PID 2252 wrote to memory of 1620	2252	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	31
PID 2252 wrote to memory of 1620	2252	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	31
PID 2252 wrote to memory of 1620	2252	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\_aa.bat
  2⤵
  - Deletes itself
  PID:1620

C:\Windows\SysWOW64\_aa.bat

Filesize
224B

MD5
9e1285601272f1d2ab832b9050039243

SHA1
979364d06926105c92e7bd9c5ef93907f631b964

SHA256
d19ebd82dd537b793ac88af89bf06b8e5e7ef8785532163acf9c38f52202a37b

SHA512
fceafa75be71bdc3bc59d9fa9ed716382713bbb40787356eebcfbc7a5cda13fb57e8d7c38af5a11c22d1c4ffade8657ccd4fcdc9f187807b5cd8623b87836fea

Download Submit
memory/2252-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2252-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download