3f1419f4b309454738990e0c5cd5f75e497f72bc4458015d9555b1673bc045fd

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe
Size

18KB
MD5

fde700f5e425a66a8f68924eb6de62c4
SHA1

70d1a842347d755fe585929cb788a27e93f119cc
SHA256

3f1419f4b309454738990e0c5cd5f75e497f72bc4458015d9555b1673bc045fd
SHA512

dce157f07003564511f1230f20c40a077a56aaf38ddb3170cd07e46d2544cd4170aba08dfd051339ec97eba35f0d68064a16685dc4fea33c18c500fd1e93cc45
SSDEEP

384:Uz5GgE6U1k5O23KekHFvM6Is//HwYa5sNE0v40OqC5abMcxzShtdzG9oCP:UzUP6U1ar3KeklvMfkoYaATT0Gqtdzv2

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RUMDLL32.exe	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RUMDLL32.exe	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe
1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe
Token: SeDebugPrivilege	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 600	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	9
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1
PID 1740 wrote to memory of 260	1740	fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe	1

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:340

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:760
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1164
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1040
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1060
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1112
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2976
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1932
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:496
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:504

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fde700f5e425a66a8f68924eb6de62c4_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-1-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-4-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-7-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-10-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-13-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-16-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-19-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-22-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-25-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-28-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download
memory/600-31-0x0000000029A00000-0x0000000029A21000-memory.dmp

Filesize
132KB

Download