d2c37e690d3a80da2c84c5ed94c1b3aed693bb84faef5d9313166d5c040f5aa5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 20:18

Target

fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe
Size

443KB
MD5

fdecad3c2a3ca19b4b200a17ed8442d9
SHA1

11a7002c35caab42e5558157a64722b2288bdef4
SHA256

d2c37e690d3a80da2c84c5ed94c1b3aed693bb84faef5d9313166d5c040f5aa5
SHA512

6ff2a817dc341f4189f92b67123a4b033488549e1cc4b04e35d69a8a8ac2ba595b6f56909e22668561758b19d296a8722339b4cdded8b5ec2893780940899ce8
SSDEEP

6144:MWmMUsluzAEtyzjpP/CJ+jFQwDEJH2DSz2cYdrKMiXSsVJMzDyqmZY8X:5mRslOAEGCAOS2xzSKMon

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2204-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/2204-8-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\common files\java\java update\jusched.exe	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\adobe\acrotray .exe	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2204	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe
2204	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdecad3c2a3ca19b4b200a17ed8442d9_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 660
  2⤵
  - Program crash
  PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 2204
1⤵
PID:3872

memory/2204-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2204-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2204-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download