7fa1e3e27a20a7c26979f4c76be7461846434d0031a10c913995fcdcd2dde761

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:56

Target

02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe
Size

715KB
MD5

02377a2e9c80a39c470cf66c7bbd8f93
SHA1

94e65a76eebe3d70a4f4b76779d811ee0c1f797e
SHA256

7fa1e3e27a20a7c26979f4c76be7461846434d0031a10c913995fcdcd2dde761
SHA512

f24e90a23faeacea232cbd352614809d2112e63f96533a02e5b784f312e07d5f802944aa8768a6acc7ba8c96c7dd30d5c5db64738b46bafe958e88d6d208047a
SSDEEP

12288:QRkTSklU4g/n/t0EW5A0zypvJwQ5oAlK+G9svnbIk6kQQ52L8Rg08b5sZ6tPn:UUlU4gf2EW5A20Jr/kHsvbIk6OeD5

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
344	Hacker.com.cn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 344 set thread context of 3608	344	Hacker.com.cn.exe	86

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe
File created	C:\Windows\uninstel.bat	02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4540	2888	WerFault.exe	81
1836	3608	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe
Token: SeDebugPrivilege	344	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 3608	344	Hacker.com.cn.exe	86
PID 344 wrote to memory of 3608	344	Hacker.com.cn.exe	86
PID 344 wrote to memory of 3608	344	Hacker.com.cn.exe	86
PID 344 wrote to memory of 3608	344	Hacker.com.cn.exe	86
PID 344 wrote to memory of 3608	344	Hacker.com.cn.exe	86

C:\Users\Admin\AppData\Local\Temp\02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02377a2e9c80a39c470cf66c7bbd8f93_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 688
  2⤵
  - Program crash
  PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2888 -ip 2888
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3608 -ip 3608
1⤵
PID:2676

C:\Windows\Hacker.com.cn.exe

Filesize
715KB

MD5
02377a2e9c80a39c470cf66c7bbd8f93

SHA1
94e65a76eebe3d70a4f4b76779d811ee0c1f797e

SHA256
7fa1e3e27a20a7c26979f4c76be7461846434d0031a10c913995fcdcd2dde761

SHA512
f24e90a23faeacea232cbd352614809d2112e63f96533a02e5b784f312e07d5f802944aa8768a6acc7ba8c96c7dd30d5c5db64738b46bafe958e88d6d208047a

Download Submit
memory/344-6-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/344-8-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2888-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2888-3-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2888-9-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3608-7-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download