8593bb9725bee7d82868ce21ab91ca33f364d8af97f716ec8e4521b51f47ed48

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 18:49

Target

0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe
Size

21KB
MD5

0008b40754ee4ce8467265a38cd870ee
SHA1

b5da08863d1535df4d089287d53f86305f53d625
SHA256

8593bb9725bee7d82868ce21ab91ca33f364d8af97f716ec8e4521b51f47ed48
SHA512

edeed789aac4d85d9622ce8e50ac2b88ce63fe399de6b593f5a0c46b74f2571750c5916bce512ce2315cf92e68b0d6383f2e9d3237fdf8006a5165b0e369c431
SSDEEP

384:XX9PVT08VPr72i+io4Z1hPur2S9MR1MJSiwuAGA0AFuFgzt1DouWmDEW:XX9PVbVziFaDVuh9M8dwurAbAWH

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\puid.sys	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2232	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	28
PID 1276 wrote to memory of 2232	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	28
PID 1276 wrote to memory of 2232	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	28
PID 1276 wrote to memory of 2232	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1828	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	29
PID 1276 wrote to memory of 1828	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	29
PID 1276 wrote to memory of 1828	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	29
PID 1276 wrote to memory of 1828	1276	0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe	29
PID 1828 wrote to memory of 3048	1828	cmd.exe	32
PID 1828 wrote to memory of 3048	1828	cmd.exe	32
PID 1828 wrote to memory of 3048	1828	cmd.exe	32
PID 1828 wrote to memory of 3048	1828	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32 /e /p everyone:f
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f
    3⤵
    PID:3048