7243974da66be9761287ec8737bf65b185c96c34a7e9b57c4393bfa0d3c61d98

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
Size

46KB
MD5

08041e6290287a2ac3d2d758babc67b9
SHA1

e4ec9b276d7c124ece690cb5fcd510391445e9ab
SHA256

7243974da66be9761287ec8737bf65b185c96c34a7e9b57c4393bfa0d3c61d98
SHA512

5399fc52dc27b1b4589601b6521789902ed342cd908ed76f27e8b4a1a8f79831f7b1a87dcaf30b2eecc8719328c5f7f92a254e07bbda7835be0a2889566049e7
SSDEEP

768:8+aXf8qRaL8qqFaCN5iNchDJ2pyeiTTKbedRIZl61TK8C9pWf95:8+aXkGaL8raCrKch92Biib6+/8QW15

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2636	rund1132.exe

Executes dropped EXE 1 IoCs

pid	Process
2636	rund1132.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\rund1132.exe	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
File created	C:\WINDOWS\SystemDir.bat	rund1132.exe
File opened for modification	C:\WINDOWS\d11host.exe	rund1132.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2608	sc.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	rund1132.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1584	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
2636	rund1132.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2636	1584	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	28
PID 1584 wrote to memory of 2636	1584	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	28
PID 1584 wrote to memory of 2636	1584	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	28
PID 1584 wrote to memory of 2636	1584	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	28
PID 2636 wrote to memory of 2756	2636	rund1132.exe	29
PID 2636 wrote to memory of 2756	2636	rund1132.exe	29
PID 2636 wrote to memory of 2756	2636	rund1132.exe	29
PID 2636 wrote to memory of 2756	2636	rund1132.exe	29
PID 2756 wrote to memory of 2608	2756	cmd.exe	31
PID 2756 wrote to memory of 2608	2756	cmd.exe	31
PID 2756 wrote to memory of 2608	2756	cmd.exe	31
PID 2756 wrote to memory of 2608	2756	cmd.exe	31
PID 2756 wrote to memory of 2576	2756	cmd.exe	32
PID 2756 wrote to memory of 2576	2756	cmd.exe	32
PID 2756 wrote to memory of 2576	2756	cmd.exe	32
PID 2756 wrote to memory of 2576	2756	cmd.exe	32
PID 2576 wrote to memory of 2888	2576	net.exe	33
PID 2576 wrote to memory of 2888	2576	net.exe	33
PID 2576 wrote to memory of 2888	2576	net.exe	33
PID 2576 wrote to memory of 2888	2576	net.exe	33
PID 2756 wrote to memory of 2456	2756	cmd.exe	34
PID 2756 wrote to memory of 2456	2756	cmd.exe	34
PID 2756 wrote to memory of 2456	2756	cmd.exe	34
PID 2756 wrote to memory of 2456	2756	cmd.exe	34
PID 2756 wrote to memory of 2612	2756	cmd.exe	35
PID 2756 wrote to memory of 2612	2756	cmd.exe	35
PID 2756 wrote to memory of 2612	2756	cmd.exe	35
PID 2756 wrote to memory of 2612	2756	cmd.exe	35
PID 2756 wrote to memory of 2724	2756	cmd.exe	36
PID 2756 wrote to memory of 2724	2756	cmd.exe	36
PID 2756 wrote to memory of 2724	2756	cmd.exe	36
PID 2756 wrote to memory of 2724	2756	cmd.exe	36
PID 2756 wrote to memory of 2772	2756	cmd.exe	37
PID 2756 wrote to memory of 2772	2756	cmd.exe	37
PID 2756 wrote to memory of 2772	2756	cmd.exe	37
PID 2756 wrote to memory of 2772	2756	cmd.exe	37
PID 2756 wrote to memory of 2460	2756	cmd.exe	38
PID 2756 wrote to memory of 2460	2756	cmd.exe	38
PID 2756 wrote to memory of 2460	2756	cmd.exe	38
PID 2756 wrote to memory of 2460	2756	cmd.exe	38
PID 2756 wrote to memory of 2524	2756	cmd.exe	39
PID 2756 wrote to memory of 2524	2756	cmd.exe	39
PID 2756 wrote to memory of 2524	2756	cmd.exe	39
PID 2756 wrote to memory of 2524	2756	cmd.exe	39
PID 2756 wrote to memory of 3020	2756	cmd.exe	40
PID 2756 wrote to memory of 3020	2756	cmd.exe	40
PID 2756 wrote to memory of 3020	2756	cmd.exe	40
PID 2756 wrote to memory of 3020	2756	cmd.exe	40
PID 2756 wrote to memory of 1968	2756	cmd.exe	41
PID 2756 wrote to memory of 1968	2756	cmd.exe	41
PID 2756 wrote to memory of 1968	2756	cmd.exe	41
PID 2756 wrote to memory of 1968	2756	cmd.exe	41
PID 2756 wrote to memory of 2980	2756	cmd.exe	42
PID 2756 wrote to memory of 2980	2756	cmd.exe	42
PID 2756 wrote to memory of 2980	2756	cmd.exe	42
PID 2756 wrote to memory of 2980	2756	cmd.exe	42
PID 2756 wrote to memory of 1228	2756	cmd.exe	43
PID 2756 wrote to memory of 1228	2756	cmd.exe	43
PID 2756 wrote to memory of 1228	2756	cmd.exe	43
PID 2756 wrote to memory of 1228	2756	cmd.exe	43
PID 2756 wrote to memory of 2720	2756	cmd.exe	44
PID 2756 wrote to memory of 2720	2756	cmd.exe	44
PID 2756 wrote to memory of 2720	2756	cmd.exe	44
PID 2756 wrote to memory of 2720	2756	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584
- C:\WINDOWS\rund1132.exe
  C:\WINDOWS\rund1132.exe C:\Users\Admin\AppData\Local\Temp\08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\WINDOWS\SystemDir.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= AUTO
      4⤵
      Launches sc.exe
      PID:2608
  - - C:\Windows\SysWOW64\net.exe
      net start schedule
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start schedule
        5⤵
        
        PID:2888
  - - C:\Windows\SysWOW64\at.exe
      AT 0:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\at.exe
      AT 1:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\at.exe
      AT 2:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2724
  - - C:\Windows\SysWOW64\at.exe
      AT 3:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\at.exe
      AT 4:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\at.exe
      AT 5:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2524
  - - C:\Windows\SysWOW64\at.exe
      AT 6:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\at.exe
      AT 7:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\at.exe
      AT 8:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\at.exe
      AT 9:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\at.exe
      AT 10:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2720
  - - C:\Windows\SysWOW64\at.exe
      AT 11:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2684
  - - C:\Windows\SysWOW64\at.exe
      AT 12:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\at.exe
      AT 13:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2820
  - - C:\Windows\SysWOW64\at.exe
      AT 14:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\at.exe
      AT 15:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\at.exe
      AT 16:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:108
  - - C:\Windows\SysWOW64\at.exe
      AT 17:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\at.exe
      AT 18:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\at.exe
      AT 19:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\at.exe
      AT 20:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\at.exe
      AT 21:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\at.exe
      AT 22:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\at.exe
      AT 23:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2656
  - - C:\Windows\SysWOW64\at.exe
      AT 0:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\at.exe
      AT 1:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\at.exe
      AT 2:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1336
  - - C:\Windows\SysWOW64\at.exe
      AT 3:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\at.exe
      AT 4:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2488
  - - C:\Windows\SysWOW64\at.exe
      AT 5:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2868
  - - C:\Windows\SysWOW64\at.exe
      AT 6:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\at.exe
      AT 7:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2840
  - - C:\Windows\SysWOW64\at.exe
      AT 8:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1852
  - - C:\Windows\SysWOW64\at.exe
      AT 9:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:872
  - - C:\Windows\SysWOW64\at.exe
      AT 10:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\at.exe
      AT 11:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\at.exe
      AT 12:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\at.exe
      AT 13:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1420
  - - C:\Windows\SysWOW64\at.exe
      AT 14:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\at.exe
      AT 15:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\at.exe
      AT 16:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1864
  - - C:\Windows\SysWOW64\at.exe
      AT 17:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3008
  - - C:\Windows\SysWOW64\at.exe
      AT 18:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:412
  - - C:\Windows\SysWOW64\at.exe
      AT 19:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\at.exe
      AT 20:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\at.exe
      AT 21:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\at.exe
      AT 22:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\at.exe
      AT 23:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SystemDir.bat

Filesize
3KB

MD5
10e2f7de449e709034d8e3f645ffbfd0

SHA1
c1af15c66194014a7bc3433ea764f609a3a357dd

SHA256
021189bf84dd3ba86178cd85a903d4ef41e80396710a368f5d6b0586e987662e

SHA512
a16925febe5e39b3c89843f151544b71d62843ee7d0090c20a3f323b91739a8fd5e365d32f5b3473102689b30bfd5763015897b75137ef6dba9da5beead08dee

Download Submit
C:\Windows\rund1132.exe

Filesize
46KB

MD5
471e1069655b2a2140bc0dd8eae7cc02

SHA1
6b998ceda2e7afcd235bbee47e85b2400f0ba6f4

SHA256
0ef38e41e9ad3ce8bc29ca4825024e1082e15eb265beb06f49daf1f10433de8a

SHA512
15f98e8c7fa7f64477db1d244c4407ead3e60a9a1b02e7358fe1537f3f6f9f35c67adb391a61e0856a8b181b033548c8a3fc8c468d4af64152ae756f0fab3309

Download Submit
memory/1584-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1584-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1584-11-0x00000000002A0000-0x00000000002BE000-memory.dmp

Filesize
120KB

Download
memory/1584-10-0x00000000002A0000-0x00000000002BE000-memory.dmp

Filesize
120KB

Download
memory/1584-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2636-13-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2636-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2636-49-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download