c554ef3f84544ffff3ac51bf09f1c722301f994253b337a6273aefecf64bdc8f

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe
Size

322KB
MD5

0fba0d2796328669ccf3e0eaa2bce381
SHA1

417b224f941552228032875fa68ab741148967ed
SHA256

c554ef3f84544ffff3ac51bf09f1c722301f994253b337a6273aefecf64bdc8f
SHA512

e4902b3b7964f146a1581c29f044d08d8c6ac934aa10d4c8e853312e45f4773fcd2b94aac4a9b8856700164439176abbc9bf5b8d805cfcce97b9e3557410e08f
SSDEEP

6144:mUU6zBaJaS4DVaBhs6cvo9Lla/pzA+V1/9S+e/st:a6zBY2pafcvcLla/psk/a/s

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/724-1-0x0000000000400000-0x0000000000484000-memory.dmp	upx
behavioral2/memory/724-15-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral2/memory/724-13-0x0000000000400000-0x0000000000484000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe
724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe
724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe
724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe
Token: SeDebugPrivilege	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 3452	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	56
PID 724 wrote to memory of 612	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	5
PID 724 wrote to memory of 676	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	7
PID 724 wrote to memory of 772	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	8
PID 724 wrote to memory of 780	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	9
PID 724 wrote to memory of 844	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	10
PID 724 wrote to memory of 908	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	11
PID 724 wrote to memory of 960	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	12
PID 724 wrote to memory of 384	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	13
PID 724 wrote to memory of 408	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	14
PID 724 wrote to memory of 1044	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	15
PID 724 wrote to memory of 1052	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	16
PID 724 wrote to memory of 1136	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	17
PID 724 wrote to memory of 1160	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	18
PID 724 wrote to memory of 1168	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	19
PID 724 wrote to memory of 1180	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	20
PID 724 wrote to memory of 1244	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	21
PID 724 wrote to memory of 1296	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	22
PID 724 wrote to memory of 1332	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	23
PID 724 wrote to memory of 1412	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	24
PID 724 wrote to memory of 1496	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	25
PID 724 wrote to memory of 1536	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	26
PID 724 wrote to memory of 1544	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	27
PID 724 wrote to memory of 1656	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	28
PID 724 wrote to memory of 1680	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	29
PID 724 wrote to memory of 1744	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	30
PID 724 wrote to memory of 1764	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	31
PID 724 wrote to memory of 1852	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	32
PID 724 wrote to memory of 1968	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	33
PID 724 wrote to memory of 2016	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	34
PID 724 wrote to memory of 1712	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	35
PID 724 wrote to memory of 1704	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	36
PID 724 wrote to memory of 2068	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	37
PID 724 wrote to memory of 2124	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	38
PID 724 wrote to memory of 2244	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	39
PID 724 wrote to memory of 2288	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	40
PID 724 wrote to memory of 2388	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	41
PID 724 wrote to memory of 2472	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	42
PID 724 wrote to memory of 2480	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	43
PID 724 wrote to memory of 2628	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	44
PID 724 wrote to memory of 2680	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	45
PID 724 wrote to memory of 2704	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	46
PID 724 wrote to memory of 2748	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	47
PID 724 wrote to memory of 2756	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	48
PID 724 wrote to memory of 2960	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	49
PID 724 wrote to memory of 3000	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	50
PID 724 wrote to memory of 3012	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	51
PID 724 wrote to memory of 2060	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	52
PID 724 wrote to memory of 2744	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	54
PID 724 wrote to memory of 3340	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	55
PID 724 wrote to memory of 3452	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	56
PID 724 wrote to memory of 3568	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	57
PID 724 wrote to memory of 3744	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	58
PID 724 wrote to memory of 3836	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	59
PID 724 wrote to memory of 3900	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	60
PID 724 wrote to memory of 3976	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	61
PID 724 wrote to memory of 3588	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	62
PID 724 wrote to memory of 4428	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	64
PID 724 wrote to memory of 3988	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	66
PID 724 wrote to memory of 3624	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	67
PID 724 wrote to memory of 4928	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	68
PID 724 wrote to memory of 1176	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	69
PID 724 wrote to memory of 2308	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	70
PID 724 wrote to memory of 4936	724	0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe	71

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:772
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:384

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:844
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2960
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3744
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3836
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3900
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3976
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3588
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4428
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3988
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4344
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:628
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:1060
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2060
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1496
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2680

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3340

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0fba0d2796328669ccf3e0eaa2bce381_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4936

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/724-0-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/724-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/724-15-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/724-13-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/724-12-0x0000000002630000-0x0000000002632000-memory.dmp

Filesize
8KB

Download
memory/3452-3-0x000000000EA00000-0x000000000EA84000-memory.dmp

Filesize
528KB

Download
memory/3452-56-0x000000000EB00000-0x000000000EB8C000-memory.dmp

Filesize
560KB

Download