Overview

overview

7

Static

static

3

19d7bd17b9...18.exe

windows7-x64

7

19d7bd17b9...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 10:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    19d7bd17b9ebb6180b82d11f88ef6b1f_JaffaCakes118.exe

  • Size

    10KB

  • MD5

    19d7bd17b9ebb6180b82d11f88ef6b1f

  • SHA1

    743e9734a8c9aeace11c587f2a376d6fdf973fb5

  • SHA256

    286ffeb0f700a56deb871afe19ce11967afda098a3e8898452e6039c5a8a1215

  • SHA512

    fad804dd4cb6a82ddbf283395e71d177abcdb4a2662bcdeabb772d97850b5bfd0c6c334f6da1dd850fcc71007c3d2753ea521a99752d6c21c55fb6f2203ce535

  • SSDEEP

    192:TA+wjFvgraEstF2E/YF7YucoguBefcAa4PECHYVgoYFkgUwuvh2:TA+wFoVp/7ZFef9aME1VdYqH2

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1232
      • C:\Users\Admin\AppData\Local\Temp\19d7bd17b9ebb6180b82d11f88ef6b1f_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\19d7bd17b9ebb6180b82d11f88ef6b1f_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Windows\SysWOW64\r18029.exe
          C:\Windows\system32\r18029.exe C:\Users\Admin\AppData\Local\Temp\~f761dfc.~~~ abcdef C:\Users\Admin\AppData\Local\Temp\19d7bd17b9ebb6180b82d11f88ef6b1f_JaffaCakes118.exe
          3⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2376

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\~f761dfc.~~~
            Filesize

            26KB

            MD5

            963202b867503df9d2722e03de0015d3

            SHA1

            ded23c11ac25523faf985c003605aeae029abd23

            SHA256

            89b10e95fc6c4bedc08e069d5cf536c808e81faabbc91d0ddf9a06eabc04bbc2

            SHA512

            dde18d6736ac0c59679ad3217d1a53e2adb0a5b9e43715ed6b5514cf61fbb1c0fff36d4bbd95f5bed7d797c7ed1061c49d070835ab41bfc06dd73de560a0899d

            Download Submit

          • \Windows\SysWOW64\r18029.exe
            Filesize

            43KB

            MD5

            51138beea3e2c21ec44d0932c71762a8

            SHA1

            8939cf35447b22dd2c6e6f443446acc1bf986d58

            SHA256

            5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

            SHA512

            794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

            Download Submit

          • memory/1232-17-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2376-10-0x0000000010000000-0x000000001001A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/2592-1-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

            Download