Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 13:38

General

  • Target

    067e52f8f51d0ebc3500386943f3891c_JaffaCakes118.exe

  • Size

    438KB

  • MD5

    067e52f8f51d0ebc3500386943f3891c

  • SHA1

    79cf4bb78b46a77d21b12bf7032c2fbf4a7ed0a2

  • SHA256

    43257dbb1e6e811091f595d08030509f64f34a3fdb434912594ca23527f58467

  • SHA512

    b96394357f6f898e7a2528b0c2804b6814aa386fc625fe4d519e0b6b23876633d8471a27d31ba844667b36125fa51fce727feb399075553beb46c4a2b5c76856

  • SSDEEP

    6144:cBPCuMgwO58zDWoGWT2UUgwB1U5cPAAJUgGqGj+iOMOMEVP1AR/A98gWNlPTGQQt:cTwS8eoGWSb1Lxy2rtAR/zNtTird4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\067e52f8f51d0ebc3500386943f3891c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\067e52f8f51d0ebc3500386943f3891c_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
      2⤵
        PID:5076
    • C:\Windows\Hacker.com.cn.exe
      C:\Windows\Hacker.com.cn.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4952

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Hacker.com.cn.exe

      Filesize

      438KB

      MD5

      067e52f8f51d0ebc3500386943f3891c

      SHA1

      79cf4bb78b46a77d21b12bf7032c2fbf4a7ed0a2

      SHA256

      43257dbb1e6e811091f595d08030509f64f34a3fdb434912594ca23527f58467

      SHA512

      b96394357f6f898e7a2528b0c2804b6814aa386fc625fe4d519e0b6b23876633d8471a27d31ba844667b36125fa51fce727feb399075553beb46c4a2b5c76856

    • C:\Windows\uninstal.bat

      Filesize

      218B

      MD5

      53fac45070988c2db633617ac2217025

      SHA1

      38812f982c7c84cd392165b46f51d70a0cd76b32

      SHA256

      23c950293e0983f6bab3a1ba52af275a06c6a445e542ac45fe438b975213677f

      SHA512

      9a1eeac606a56141201fc9d6b5a1a1ea444b0c4619fb0743d2e5ccf4143d9459b59e4863ac201072e8bae02f93d23c2135ffdaceee2cf3c460b3a2975ba81d0f

    • memory/4952-89-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/4952-90-0x00000000007C0000-0x0000000000803000-memory.dmp

      Filesize

      268KB

    • memory/4952-96-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/4952-102-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/4952-98-0x00000000007C0000-0x0000000000803000-memory.dmp

      Filesize

      268KB

    • memory/4952-97-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/5000-6-0x00000000023A0000-0x00000000023A1000-memory.dmp

      Filesize

      4KB

    • memory/5000-19-0x0000000002470000-0x0000000002471000-memory.dmp

      Filesize

      4KB

    • memory/5000-43-0x0000000002350000-0x0000000002351000-memory.dmp

      Filesize

      4KB

    • memory/5000-42-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/5000-41-0x0000000002840000-0x0000000002841000-memory.dmp

      Filesize

      4KB

    • memory/5000-40-0x0000000002810000-0x0000000002811000-memory.dmp

      Filesize

      4KB

    • memory/5000-38-0x00000000026D0000-0x00000000026D1000-memory.dmp

      Filesize

      4KB

    • memory/5000-39-0x00000000026C0000-0x00000000026C1000-memory.dmp

      Filesize

      4KB

    • memory/5000-37-0x00000000026A0000-0x00000000026A1000-memory.dmp

      Filesize

      4KB

    • memory/5000-36-0x00000000026B0000-0x00000000026B1000-memory.dmp

      Filesize

      4KB

    • memory/5000-35-0x0000000002680000-0x0000000002681000-memory.dmp

      Filesize

      4KB

    • memory/5000-34-0x0000000002690000-0x0000000002691000-memory.dmp

      Filesize

      4KB

    • memory/5000-33-0x0000000002650000-0x0000000002651000-memory.dmp

      Filesize

      4KB

    • memory/5000-32-0x0000000002660000-0x0000000002661000-memory.dmp

      Filesize

      4KB

    • memory/5000-31-0x0000000002630000-0x0000000002631000-memory.dmp

      Filesize

      4KB

    • memory/5000-30-0x0000000002640000-0x0000000002641000-memory.dmp

      Filesize

      4KB

    • memory/5000-29-0x0000000002610000-0x0000000002611000-memory.dmp

      Filesize

      4KB

    • memory/5000-84-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

      Filesize

      4KB

    • memory/5000-27-0x00000000024F0000-0x00000000024F1000-memory.dmp

      Filesize

      4KB

    • memory/5000-26-0x0000000002500000-0x0000000002501000-memory.dmp

      Filesize

      4KB

    • memory/5000-25-0x00000000024D0000-0x00000000024D1000-memory.dmp

      Filesize

      4KB

    • memory/5000-24-0x00000000024E0000-0x00000000024E1000-memory.dmp

      Filesize

      4KB

    • memory/5000-23-0x00000000024B0000-0x00000000024B1000-memory.dmp

      Filesize

      4KB

    • memory/5000-22-0x00000000024C0000-0x00000000024C1000-memory.dmp

      Filesize

      4KB

    • memory/5000-21-0x0000000002490000-0x0000000002491000-memory.dmp

      Filesize

      4KB

    • memory/5000-20-0x00000000024A0000-0x00000000024A1000-memory.dmp

      Filesize

      4KB

    • memory/5000-48-0x0000000002830000-0x0000000002831000-memory.dmp

      Filesize

      4KB

    • memory/5000-18-0x0000000002480000-0x0000000002481000-memory.dmp

      Filesize

      4KB

    • memory/5000-17-0x0000000002450000-0x0000000002451000-memory.dmp

      Filesize

      4KB

    • memory/5000-15-0x0000000002430000-0x0000000002431000-memory.dmp

      Filesize

      4KB

    • memory/5000-14-0x0000000002440000-0x0000000002441000-memory.dmp

      Filesize

      4KB

    • memory/5000-13-0x0000000002410000-0x0000000002411000-memory.dmp

      Filesize

      4KB

    • memory/5000-12-0x0000000002420000-0x0000000002421000-memory.dmp

      Filesize

      4KB

    • memory/5000-11-0x00000000023F0000-0x00000000023F1000-memory.dmp

      Filesize

      4KB

    • memory/5000-10-0x0000000002400000-0x0000000002401000-memory.dmp

      Filesize

      4KB

    • memory/5000-9-0x00000000023C0000-0x00000000023C1000-memory.dmp

      Filesize

      4KB

    • memory/5000-8-0x0000000002370000-0x0000000002371000-memory.dmp

      Filesize

      4KB

    • memory/5000-7-0x0000000002360000-0x0000000002361000-memory.dmp

      Filesize

      4KB

    • memory/5000-45-0x0000000002850000-0x0000000002851000-memory.dmp

      Filesize

      4KB

    • memory/5000-3-0x0000000002130000-0x0000000002131000-memory.dmp

      Filesize

      4KB

    • memory/5000-2-0x0000000002140000-0x0000000002141000-memory.dmp

      Filesize

      4KB

    • memory/5000-1-0x0000000002180000-0x00000000021C3000-memory.dmp

      Filesize

      268KB

    • memory/5000-76-0x0000000002D50000-0x0000000002D51000-memory.dmp

      Filesize

      4KB

    • memory/5000-44-0x0000000002820000-0x0000000002821000-memory.dmp

      Filesize

      4KB

    • memory/5000-28-0x0000000002620000-0x0000000002621000-memory.dmp

      Filesize

      4KB

    • memory/5000-83-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

      Filesize

      4KB

    • memory/5000-82-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

      Filesize

      4KB

    • memory/5000-81-0x0000000002D80000-0x0000000002D81000-memory.dmp

      Filesize

      4KB

    • memory/5000-80-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

      Filesize

      4KB

    • memory/5000-79-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

      Filesize

      4KB

    • memory/5000-78-0x0000000002D90000-0x0000000002D91000-memory.dmp

      Filesize

      4KB

    • memory/5000-77-0x0000000002D70000-0x0000000002D71000-memory.dmp

      Filesize

      4KB

    • memory/5000-4-0x0000000002390000-0x0000000002393000-memory.dmp

      Filesize

      12KB

    • memory/5000-75-0x0000000002D60000-0x0000000002D61000-memory.dmp

      Filesize

      4KB

    • memory/5000-74-0x0000000002D30000-0x0000000002D31000-memory.dmp

      Filesize

      4KB

    • memory/5000-73-0x0000000002D40000-0x0000000002D41000-memory.dmp

      Filesize

      4KB

    • memory/5000-72-0x0000000002D10000-0x0000000002D11000-memory.dmp

      Filesize

      4KB

    • memory/5000-71-0x0000000002D20000-0x0000000002D21000-memory.dmp

      Filesize

      4KB

    • memory/5000-70-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

      Filesize

      4KB

    • memory/5000-69-0x0000000002D00000-0x0000000002D01000-memory.dmp

      Filesize

      4KB

    • memory/5000-68-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

      Filesize

      4KB

    • memory/5000-67-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

      Filesize

      4KB

    • memory/5000-66-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

      Filesize

      4KB

    • memory/5000-65-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

      Filesize

      4KB

    • memory/5000-64-0x0000000002C90000-0x0000000002C91000-memory.dmp

      Filesize

      4KB

    • memory/5000-63-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

      Filesize

      4KB

    • memory/5000-62-0x0000000002C70000-0x0000000002C71000-memory.dmp

      Filesize

      4KB

    • memory/5000-61-0x0000000002C80000-0x0000000002C81000-memory.dmp

      Filesize

      4KB

    • memory/5000-60-0x0000000002910000-0x0000000002911000-memory.dmp

      Filesize

      4KB

    • memory/5000-59-0x0000000002920000-0x0000000002921000-memory.dmp

      Filesize

      4KB

    • memory/5000-58-0x00000000028F0000-0x00000000028F1000-memory.dmp

      Filesize

      4KB

    • memory/5000-57-0x0000000002900000-0x0000000002901000-memory.dmp

      Filesize

      4KB

    • memory/5000-56-0x00000000028D0000-0x00000000028D1000-memory.dmp

      Filesize

      4KB

    • memory/5000-55-0x00000000028E0000-0x00000000028E1000-memory.dmp

      Filesize

      4KB

    • memory/5000-54-0x00000000028B0000-0x00000000028B1000-memory.dmp

      Filesize

      4KB

    • memory/5000-53-0x00000000028C0000-0x00000000028C1000-memory.dmp

      Filesize

      4KB

    • memory/5000-52-0x0000000002890000-0x0000000002891000-memory.dmp

      Filesize

      4KB

    • memory/5000-51-0x00000000028A0000-0x00000000028A1000-memory.dmp

      Filesize

      4KB

    • memory/5000-50-0x0000000002870000-0x0000000002871000-memory.dmp

      Filesize

      4KB

    • memory/5000-49-0x0000000002880000-0x0000000002881000-memory.dmp

      Filesize

      4KB

    • memory/5000-86-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

      Filesize

      4KB

    • memory/5000-85-0x0000000002E00000-0x0000000002E01000-memory.dmp

      Filesize

      4KB

    • memory/5000-16-0x0000000002460000-0x0000000002461000-memory.dmp

      Filesize

      4KB

    • memory/5000-5-0x0000000002380000-0x0000000002381000-memory.dmp

      Filesize

      4KB

    • memory/5000-0-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/5000-93-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/5000-94-0x0000000002180000-0x00000000021C3000-memory.dmp

      Filesize

      268KB