7243974da66be9761287ec8737bf65b185c96c34a7e9b57c4393bfa0d3c61d98

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
Size

46KB
MD5

08041e6290287a2ac3d2d758babc67b9
SHA1

e4ec9b276d7c124ece690cb5fcd510391445e9ab
SHA256

7243974da66be9761287ec8737bf65b185c96c34a7e9b57c4393bfa0d3c61d98
SHA512

5399fc52dc27b1b4589601b6521789902ed342cd908ed76f27e8b4a1a8f79831f7b1a87dcaf30b2eecc8719328c5f7f92a254e07bbda7835be0a2889566049e7
SSDEEP

768:8+aXf8qRaL8qqFaCN5iNchDJ2pyeiTTKbedRIZl61TK8C9pWf95:8+aXkGaL8raCrKch92Biib6+/8QW15

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4968	rund1132.exe

Executes dropped EXE 1 IoCs

pid	Process
4968	rund1132.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\rund1132.exe	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
File created	C:\WINDOWS\SystemDir.bat	rund1132.exe
File opened for modification	C:\WINDOWS\d11host.exe	rund1132.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
936	sc.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	rund1132.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1452	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
4968	rund1132.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 4968	1452	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	80
PID 1452 wrote to memory of 4968	1452	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	80
PID 1452 wrote to memory of 4968	1452	08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe	80
PID 4968 wrote to memory of 4220	4968	rund1132.exe	81
PID 4968 wrote to memory of 4220	4968	rund1132.exe	81
PID 4968 wrote to memory of 4220	4968	rund1132.exe	81
PID 4220 wrote to memory of 936	4220	cmd.exe	83
PID 4220 wrote to memory of 936	4220	cmd.exe	83
PID 4220 wrote to memory of 936	4220	cmd.exe	83
PID 4220 wrote to memory of 1972	4220	cmd.exe	84
PID 4220 wrote to memory of 1972	4220	cmd.exe	84
PID 4220 wrote to memory of 1972	4220	cmd.exe	84
PID 1972 wrote to memory of 2336	1972	net.exe	85
PID 1972 wrote to memory of 2336	1972	net.exe	85
PID 1972 wrote to memory of 2336	1972	net.exe	85
PID 4220 wrote to memory of 3652	4220	cmd.exe	86
PID 4220 wrote to memory of 3652	4220	cmd.exe	86
PID 4220 wrote to memory of 3652	4220	cmd.exe	86
PID 4220 wrote to memory of 804	4220	cmd.exe	87
PID 4220 wrote to memory of 804	4220	cmd.exe	87
PID 4220 wrote to memory of 804	4220	cmd.exe	87
PID 4220 wrote to memory of 1684	4220	cmd.exe	88
PID 4220 wrote to memory of 1684	4220	cmd.exe	88
PID 4220 wrote to memory of 1684	4220	cmd.exe	88
PID 4220 wrote to memory of 548	4220	cmd.exe	89
PID 4220 wrote to memory of 548	4220	cmd.exe	89
PID 4220 wrote to memory of 548	4220	cmd.exe	89
PID 4220 wrote to memory of 4544	4220	cmd.exe	90
PID 4220 wrote to memory of 4544	4220	cmd.exe	90
PID 4220 wrote to memory of 4544	4220	cmd.exe	90
PID 4220 wrote to memory of 1596	4220	cmd.exe	91
PID 4220 wrote to memory of 1596	4220	cmd.exe	91
PID 4220 wrote to memory of 1596	4220	cmd.exe	91
PID 4220 wrote to memory of 1060	4220	cmd.exe	92
PID 4220 wrote to memory of 1060	4220	cmd.exe	92
PID 4220 wrote to memory of 1060	4220	cmd.exe	92
PID 4220 wrote to memory of 2388	4220	cmd.exe	93
PID 4220 wrote to memory of 2388	4220	cmd.exe	93
PID 4220 wrote to memory of 2388	4220	cmd.exe	93
PID 4220 wrote to memory of 1872	4220	cmd.exe	94
PID 4220 wrote to memory of 1872	4220	cmd.exe	94
PID 4220 wrote to memory of 1872	4220	cmd.exe	94
PID 4220 wrote to memory of 1208	4220	cmd.exe	95
PID 4220 wrote to memory of 1208	4220	cmd.exe	95
PID 4220 wrote to memory of 1208	4220	cmd.exe	95
PID 4220 wrote to memory of 1904	4220	cmd.exe	96
PID 4220 wrote to memory of 1904	4220	cmd.exe	96
PID 4220 wrote to memory of 1904	4220	cmd.exe	96
PID 4220 wrote to memory of 3944	4220	cmd.exe	97
PID 4220 wrote to memory of 3944	4220	cmd.exe	97
PID 4220 wrote to memory of 3944	4220	cmd.exe	97
PID 4220 wrote to memory of 1772	4220	cmd.exe	98
PID 4220 wrote to memory of 1772	4220	cmd.exe	98
PID 4220 wrote to memory of 1772	4220	cmd.exe	98
PID 4220 wrote to memory of 456	4220	cmd.exe	99
PID 4220 wrote to memory of 456	4220	cmd.exe	99
PID 4220 wrote to memory of 456	4220	cmd.exe	99
PID 4220 wrote to memory of 1236	4220	cmd.exe	100
PID 4220 wrote to memory of 1236	4220	cmd.exe	100
PID 4220 wrote to memory of 1236	4220	cmd.exe	100
PID 4220 wrote to memory of 2168	4220	cmd.exe	101
PID 4220 wrote to memory of 2168	4220	cmd.exe	101
PID 4220 wrote to memory of 2168	4220	cmd.exe	101
PID 4220 wrote to memory of 4796	4220	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\WINDOWS\rund1132.exe
  C:\WINDOWS\rund1132.exe C:\Users\Admin\AppData\Local\Temp\08041e6290287a2ac3d2d758babc67b9_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\SystemDir.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= AUTO
      4⤵
      Launches sc.exe
      PID:936
  - - C:\Windows\SysWOW64\net.exe
      net start schedule
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start schedule
        5⤵
        
        PID:2336
  - - C:\Windows\SysWOW64\at.exe
      AT 0:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3652
  - - C:\Windows\SysWOW64\at.exe
      AT 1:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\at.exe
      AT 2:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\at.exe
      AT 3:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\at.exe
      AT 4:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\at.exe
      AT 5:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\at.exe
      AT 6:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\at.exe
      AT 7:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2388
  - - C:\Windows\SysWOW64\at.exe
      AT 8:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\at.exe
      AT 9:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1208
  - - C:\Windows\SysWOW64\at.exe
      AT 10:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\at.exe
      AT 11:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\at.exe
      AT 12:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\at.exe
      AT 13:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:456
  - - C:\Windows\SysWOW64\at.exe
      AT 14:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1236
  - - C:\Windows\SysWOW64\at.exe
      AT 15:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\at.exe
      AT 16:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4796
  - - C:\Windows\SysWOW64\at.exe
      AT 17:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\at.exe
      AT 18:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4692
  - - C:\Windows\SysWOW64\at.exe
      AT 19:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\at.exe
      AT 20:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\at.exe
      AT 21:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3900
  - - C:\Windows\SysWOW64\at.exe
      AT 22:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2888
  - - C:\Windows\SysWOW64\at.exe
      AT 23:00 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4216
  - - C:\Windows\SysWOW64\at.exe
      AT 0:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2648
  - - C:\Windows\SysWOW64\at.exe
      AT 1:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3616
  - - C:\Windows\SysWOW64\at.exe
      AT 2:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2476
  - - C:\Windows\SysWOW64\at.exe
      AT 3:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4008
  - - C:\Windows\SysWOW64\at.exe
      AT 4:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\at.exe
      AT 5:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\at.exe
      AT 6:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\at.exe
      AT 7:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1116
  - - C:\Windows\SysWOW64\at.exe
      AT 8:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3416
  - - C:\Windows\SysWOW64\at.exe
      AT 9:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\at.exe
      AT 10:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2516
  - - C:\Windows\SysWOW64\at.exe
      AT 11:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\at.exe
      AT 12:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\at.exe
      AT 13:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2120
  - - C:\Windows\SysWOW64\at.exe
      AT 14:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\at.exe
      AT 15:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\at.exe
      AT 16:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\at.exe
      AT 17:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\at.exe
      AT 18:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\at.exe
      AT 19:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\at.exe
      AT 20:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\at.exe
      AT 21:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:3308
  - - C:\Windows\SysWOW64\at.exe
      AT 22:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\at.exe
      AT 23:30 /interactive /every:M,T,W,Th,F,S,Su C:\WINDOWS\rund1132.exe
      4⤵
      PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SystemDir.bat

Filesize
3KB

MD5
10e2f7de449e709034d8e3f645ffbfd0

SHA1
c1af15c66194014a7bc3433ea764f609a3a357dd

SHA256
021189bf84dd3ba86178cd85a903d4ef41e80396710a368f5d6b0586e987662e

SHA512
a16925febe5e39b3c89843f151544b71d62843ee7d0090c20a3f323b91739a8fd5e365d32f5b3473102689b30bfd5763015897b75137ef6dba9da5beead08dee

Download Submit
C:\Windows\rund1132.exe

Filesize
46KB

MD5
471e1069655b2a2140bc0dd8eae7cc02

SHA1
6b998ceda2e7afcd235bbee47e85b2400f0ba6f4

SHA256
0ef38e41e9ad3ce8bc29ca4825024e1082e15eb265beb06f49daf1f10433de8a

SHA512
15f98e8c7fa7f64477db1d244c4407ead3e60a9a1b02e7358fe1537f3f6f9f35c67adb391a61e0856a8b181b033548c8a3fc8c468d4af64152ae756f0fab3309

Download Submit
memory/1452-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1452-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/1452-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4968-8-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/4968-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download