02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
Size

460KB
MD5

3a75ad36745a128836896eb0ac1bea80
SHA1

0b9c0364ae194f2cc75e05c29d26eed6e7fd9223
SHA256

02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455
SHA512

60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9
SSDEEP

6144:Ab/2Sw+oJEdJGpT42yoW4RYMnlYnnzsEpPRvutJTtgWfOiMY3NewDyNYu:6kE/O4OW4SkYnnzlptuzhfOg3NRI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	ppzltcqvggths.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	ppzltcqvggths.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1480	ppzltcqvggths.exe
1480	ppzltcqvggths.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1480	220	3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe	82
PID 220 wrote to memory of 1480	220	3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe
  "C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\parent.txt

Filesize
460KB

MD5
3a75ad36745a128836896eb0ac1bea80

SHA1
0b9c0364ae194f2cc75e05c29d26eed6e7fd9223

SHA256
02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455

SHA512
60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe

Filesize
7KB

MD5
e866084611bc2075e4f5e6f265144f20

SHA1
89e62a9c1ef200c5c35af37ec5169d6ee805a535

SHA256
a69c21088dd3cc1b86be21ff9784f9d87f083bd2317dc4c8b0b3982ee187250a

SHA512
c3ddbf564cfb30c977c59aa8f3e3f921e7d3cf1b934c35a22384f7eec45447cf37e25cbc12286fe26c5aed1cff856d65d08412cb5e2633c22b788fdeb9e57b86

Download Submit
memory/1480-8-0x000000001C4B0000-0x000000001C97E000-memory.dmp

Filesize
4.8MB

Download
memory/1480-13-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-7-0x000000001BFA0000-0x000000001BFE4000-memory.dmp

Filesize
272KB

Download
memory/1480-9-0x000000001CA20000-0x000000001CABC000-memory.dmp

Filesize
624KB

Download
memory/1480-10-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-11-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

Filesize
32KB

Download
memory/1480-12-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-6-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-14-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-15-0x000000001EC20000-0x000000001EC82000-memory.dmp

Filesize
392KB

Download
memory/1480-5-0x00007FFADA365000-0x00007FFADA366000-memory.dmp

Filesize
4KB

Download
memory/1480-18-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-27-0x0000000022210000-0x00000000229B6000-memory.dmp

Filesize
7.6MB

Download
memory/1480-28-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

Filesize
9.6MB

Download
memory/1480-29-0x00007FFADA365000-0x00007FFADA366000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads