64c90977084d9be978086a77c92a55ee0f00793d1ccb7a2287aa6cf1c25743d8

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe
Size

4.9MB
MD5

9ad34bc4cabd213401c64a984512577e
SHA1

22de7b41e7dd57ab95238391a7179fe56b9b928b
SHA256

64c90977084d9be978086a77c92a55ee0f00793d1ccb7a2287aa6cf1c25743d8
SHA512

069c7afdb7a642e8ef7e220885aa04064589eb1fe92a98a4fe71e8d699127829ddb7b4c1e8717686bdedd789a1c7c73ed3f98f35a13ed74bda8c86b0407bd005
SSDEEP

98304:7X4UoiZnh3oEWci9u8CzlzvzHHA4aqmQyazx1p:rcuOVb9PCzl/naYyaN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2220	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp
2228	wBTBqFgPHYIxIo.exe

Loads dropped DLL 2 IoCs

pid	Process
1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe
2220	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2228	wBTBqFgPHYIxIo.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 1056 wrote to memory of 2220	1056	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2228	2220	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp	29
PID 2220 wrote to memory of 2228	2220	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp	29
PID 2220 wrote to memory of 2228	2220	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp	29
PID 2220 wrote to memory of 2228	2220	9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp	29

C:\Users\Admin\AppData\Local\Temp\9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\is-JT61G.tmp\9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JT61G.tmp\9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp" /SL5="$7011E,4469252,721408,C:\Users\Admin\AppData\Local\Temp\9ad34bc4cabd213401c64a984512577e_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\is-469JS.tmp\wBTBqFgPHYIxIo.exe
    "C:\Users\Admin\AppData\Local\Temp\is-469JS.tmp\wBTBqFgPHYIxIo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-469JS.tmp\wBTBqFgPHYIxIo.exe

Filesize
3.6MB

MD5
5ab440640247732a415fcac9fe14f12f

SHA1
6b16aa270138735d8b5c26c2be5e8996ef1496f0

SHA256
1b118c5e474bec04e108ba6e8e56344c8139609c6bccdb109dc9d4e8332e7bef

SHA512
68201bb575b97cbcba4e93b880a4c8731005b5da78a3d0254765ad095fec56724efc9e79e83637c01d64211417249a0663a0c38d0dfcc3356c48414d221490c8

Download Submit
\Users\Admin\AppData\Local\Temp\is-JT61G.tmp\9ad34bc4cabd213401c64a984512577e_JaffaCakes118.tmp

Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
memory/1056-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/1056-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1056-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1056-38-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2220-8-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2220-17-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2220-36-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2228-15-0x0000000000400000-0x000000000218B000-memory.dmp

Filesize
29.5MB

Download
memory/2228-18-0x0000000000400000-0x000000000218B000-memory.dmp

Filesize
29.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads