17c0ed7b14657bd05160e1cbb55066e26bb992810cd8d1846e830896efbbe5a2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68fa298e543a708ba6859e923401453c_JaffaCakes118.exe
Size

457KB
MD5

68fa298e543a708ba6859e923401453c
SHA1

833595491133b9849c901aa152cf8d9da21874c0
SHA256

17c0ed7b14657bd05160e1cbb55066e26bb992810cd8d1846e830896efbbe5a2
SHA512

2a23c5790e987e21a4027892a37edc2fa4fa368615301efa87f7579d435c9197e4167dfe14313d94252d29f3e00d80c41e164aca1ca56ad8d34f51aac1441c9e
SSDEEP

6144:OHFn/5EIFfwnb4ylKxh5Vn5TKLjgp8cAe4WDc46wCWFGmxllgMeN+anWl95YRS:yFfGb41xtn5ufgpLA46w5NlS3Wl9AS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

adgwsukbgauoppf.exe

pid process

3328 adgwsukbgauoppf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

adgwsukbgauoppf.exe

description pid process

Token: SeDebugPrivilege 3328 adgwsukbgauoppf.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

adgwsukbgauoppf.exe

pid process

3328 adgwsukbgauoppf.exe
3328 adgwsukbgauoppf.exe

pid	process
3328	adgwsukbgauoppf.exe

description	pid	process
Token: SeDebugPrivilege	3328	adgwsukbgauoppf.exe

pid	process
3328	adgwsukbgauoppf.exe
3328	adgwsukbgauoppf.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

68fa298e543a708ba6859e923401453c_JaffaCakes118.exe

description	pid	process	target process
PID 2064 wrote to memory of 3328	2064	68fa298e543a708ba6859e923401453c_JaffaCakes118.exe	adgwsukbgauoppf.exe
PID 2064 wrote to memory of 3328	2064	68fa298e543a708ba6859e923401453c_JaffaCakes118.exe	adgwsukbgauoppf.exe

C:\Users\Admin\AppData\Local\Temp\68fa298e543a708ba6859e923401453c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68fa298e543a708ba6859e923401453c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\adgwsukbgauoppf.exe
"C:\Users\Admin\AppData\Local\Temp\\adgwsukbgauoppf.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\adgwsukbgauoppf.exe

Filesize
6KB

MD5
aac5ed13dc19a296da596b37f09809b9

SHA1
9f93e6281386df5ae0525d9d3036cb4a74df4ac4

SHA256
6522244da8cb88bbf07ef2c7bdd81a62daf6e24df39d3c331a31b00d8954790e

SHA512
11e9b499670c97f0e2ab4a0d6ff6952e697d67d43c91ec84be7c817c74dc450ac98ad20cdcfbf2028de97aa69ce13de56a15481b6402b9c9d9dc158a8256ece4

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
457KB

MD5
68fa298e543a708ba6859e923401453c

SHA1
833595491133b9849c901aa152cf8d9da21874c0

SHA256
17c0ed7b14657bd05160e1cbb55066e26bb992810cd8d1846e830896efbbe5a2

SHA512
2a23c5790e987e21a4027892a37edc2fa4fa368615301efa87f7579d435c9197e4167dfe14313d94252d29f3e00d80c41e164aca1ca56ad8d34f51aac1441c9e

Download Submit
memory/3328-13-0x0000000001610000-0x0000000001618000-memory.dmp

Filesize
32KB

Download
memory/3328-14-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-8-0x000000001C100000-0x000000001C5CE000-memory.dmp

Filesize
4.8MB

Download
memory/3328-9-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-10-0x000000001C5D0000-0x000000001C66C000-memory.dmp

Filesize
624KB

Download
memory/3328-6-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-5-0x00007FFB9D1F5000-0x00007FFB9D1F6000-memory.dmp

Filesize
4KB

Download
memory/3328-7-0x00000000015D0000-0x0000000001614000-memory.dmp

Filesize
272KB

Download
memory/3328-15-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-16-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-17-0x000000001F920000-0x000000001F982000-memory.dmp

Filesize
392KB

Download
memory/3328-20-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-29-0x0000000020840000-0x0000000020CF7000-memory.dmp

Filesize
4.7MB

Download
memory/3328-30-0x00007FFB9CF40000-0x00007FFB9D8E1000-memory.dmp

Filesize
9.6MB

Download
memory/3328-31-0x00007FFB9D1F5000-0x00007FFB9D1F6000-memory.dmp

Filesize
4KB

Download