35615721a506cfaedfb189dbc33bce3bdf5fd8bdac2b78cc5cdb3f072fd83aee

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ca7fb4d5b47d60903b5afadeacb7249_JaffaCakes118.exe
Size

458KB
MD5

8ca7fb4d5b47d60903b5afadeacb7249
SHA1

fc7968b476918f1777aebd69d26fd25cdc7310ae
SHA256

35615721a506cfaedfb189dbc33bce3bdf5fd8bdac2b78cc5cdb3f072fd83aee
SHA512

6920044d797e5a8f77fe39659def09a45dd2bf03be3f32c7614024057a6c3e6c1c178166b34ef4c65276b08fd80e3f1d3861115da5de0b0650c548c34bf552af
SSDEEP

12288:eLrfmBEiFpMMSf7z9bUzI6/Sv5C/Hud3WjUR:RBEapEdbUzI/vg2QjUR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1208	iymwrhmucimp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	iymwrhmucimp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1208	iymwrhmucimp.exe
1208	iymwrhmucimp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1208	820	8ca7fb4d5b47d60903b5afadeacb7249_JaffaCakes118.exe	82
PID 820 wrote to memory of 1208	820	8ca7fb4d5b47d60903b5afadeacb7249_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\8ca7fb4d5b47d60903b5afadeacb7249_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ca7fb4d5b47d60903b5afadeacb7249_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\zpytozzlgoimvrd\iymwrhmucimp.exe
  "C:\Users\Admin\AppData\Local\Temp\zpytozzlgoimvrd\iymwrhmucimp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zpytozzlgoimvrd\iymwrhmucimp.exe

Filesize
7KB

MD5
b60e41ce61c71499292173827dd43503

SHA1
17b325412483c085661945f06f9ac86bf063d3c0

SHA256
1edd5d134662ab5d70662bd3614ffcf8ef384c63a87eba2eee033eb82c49dc46

SHA512
982e7a535549b94b2f118d19813000f4aa96fcdf2e278257daae1d6fa7bb9247b1188ada59727a79634d4453a1d613db996f865388ebdf59799f65f7e306ada3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zpytozzlgoimvrd\parent.txt

Filesize
458KB

MD5
8ca7fb4d5b47d60903b5afadeacb7249

SHA1
fc7968b476918f1777aebd69d26fd25cdc7310ae

SHA256
35615721a506cfaedfb189dbc33bce3bdf5fd8bdac2b78cc5cdb3f072fd83aee

SHA512
6920044d797e5a8f77fe39659def09a45dd2bf03be3f32c7614024057a6c3e6c1c178166b34ef4c65276b08fd80e3f1d3861115da5de0b0650c548c34bf552af

Download Submit
memory/1208-8-0x000000001BFA0000-0x000000001C46E000-memory.dmp

Filesize
4.8MB

Download
memory/1208-13-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-7-0x000000001BA90000-0x000000001BAD4000-memory.dmp

Filesize
272KB

Download
memory/1208-9-0x000000001C510000-0x000000001C5AC000-memory.dmp

Filesize
624KB

Download
memory/1208-10-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-11-0x00000000014A0000-0x00000000014A8000-memory.dmp

Filesize
32KB

Download
memory/1208-12-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-6-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-14-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-15-0x000000001E6E0000-0x000000001E742000-memory.dmp

Filesize
392KB

Download
memory/1208-5-0x00007FFB164D5000-0x00007FFB164D6000-memory.dmp

Filesize
4KB

Download
memory/1208-18-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-27-0x0000000021D10000-0x00000000224B6000-memory.dmp

Filesize
7.6MB

Download
memory/1208-28-0x00007FFB16220000-0x00007FFB16BC1000-memory.dmp

Filesize
9.6MB

Download
memory/1208-29-0x00007FFB164D5000-0x00007FFB164D6000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads