bfbbf33f4e08023343498974478587577d6da145273ddd32c6ccc3b93ce81293

Analysis

max time kernel
123s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 07:05

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-19T07:07:22Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win7-20240221-en/instance_5-dirty.qcow2\"}"

Report Analysis Logs

General

Target

f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118.exe
Size

7KB
MD5

f9c48a99ada2d27d8e1c14703eccfcdd
SHA1

4b2de616dc3c1afdc2896d051a33b4f0d64a9abb
SHA256

bfbbf33f4e08023343498974478587577d6da145273ddd32c6ccc3b93ce81293
SHA512

4e3d45b955f350897935e8c351e2508ee560c9a4b6cc741316586f2b06071bf8cc9e80fc95a6838b1c2d9ad88861e44329df983a170b2d7a8e7ca7ddad51afd1
SSDEEP

192:kaLZOYMBGG2hcKWWEVtH6nnVcOwbHicTj2P49H:k2Op0cKcOn7cPT

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118.exe
Token: 33	1520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1520	AUDIODG.EXE
Token: 33	1520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1520	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-16-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/2668-15-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/2804-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2804-3-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download