Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 14:40
Static task
static1
Behavioral task
behavioral1
Sample
06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe
-
Size
495KB
-
MD5
06ead5ba61da4779f2c285c0c4579e68
-
SHA1
4571178883a3beb7a674a5c6bb12a1740f63fac2
-
SHA256
3f3979d9bba4340181a9a25f605d9afda4c47394495fefad5b16095b767eb5ec
-
SHA512
638e72ea0be633a5c8a0e71caf17d3f1ce33341ec71245048f07f4327a085046884b78dc2091768fe7d45c5fba1c0f7d01bab21194e5a98ef554673c0e9ccf41
-
SSDEEP
12288:n1Ra1rN4wopVauKAxZkhwry8NtTirdorym:nDrp4XAx+hwry8TEdoP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3256 EntSver.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\EntSver.exe 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe File opened for modification C:\Windows\EntSver.exe 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe File created C:\Windows\GUOCYOKl.BAT 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1048 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe Token: SeDebugPrivilege 3256 EntSver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3256 EntSver.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3256 wrote to memory of 1232 3256 EntSver.exe 85 PID 3256 wrote to memory of 1232 3256 EntSver.exe 85 PID 1048 wrote to memory of 2652 1048 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe 86 PID 1048 wrote to memory of 2652 1048 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe 86 PID 1048 wrote to memory of 2652 1048 06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06ead5ba61da4779f2c285c0c4579e68_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\GUOCYOKl.BAT2⤵PID:2652
-
-
C:\Windows\EntSver.exeC:\Windows\EntSver.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:1232
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
495KB
MD506ead5ba61da4779f2c285c0c4579e68
SHA14571178883a3beb7a674a5c6bb12a1740f63fac2
SHA2563f3979d9bba4340181a9a25f605d9afda4c47394495fefad5b16095b767eb5ec
SHA512638e72ea0be633a5c8a0e71caf17d3f1ce33341ec71245048f07f4327a085046884b78dc2091768fe7d45c5fba1c0f7d01bab21194e5a98ef554673c0e9ccf41
-
Filesize
218B
MD51e58d2fefe538e105345e1ce200cf552
SHA1bbde7f2f77ceb8dcca70b1a1812960e22787b5f2
SHA2562d53fc0097a445256bdd29834c56413217adf235fc994f1ad89619b43c0da342
SHA51235fb8fc538be3d99bc9e13071aa9969cadb9bea0174270a3390f98a48526ef5d8affeccb4cb210e14493d39f39e3319a673168963db72c52b31a2b0cd9d95958