e459c11c6b457d001f06a43e6f37e320a45be835accd7b89dabbdc72f0bf42d1

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 21:31

Target

1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
Size

14KB
MD5

1c918d2f2bb7d7637d461aede42468d2
SHA1

779782ffcf81b9df601917236b7ee8fe5ca986c5
SHA256

e459c11c6b457d001f06a43e6f37e320a45be835accd7b89dabbdc72f0bf42d1
SHA512

d4b5d1f1c53c9dcb5e659ec41d1b929c569c6513f5e657755562c0e33e8d4c13e26de5b5d9adc676bb3cdaa640d86734feb439917c40ec7ca374e39f739721dc
SSDEEP

384:etHHATxHmqU8BwInGTMq1ZMbbu8qMjudsl1M3FxazSwEVr:etnsmqUi/nGTMSP8hudsl1M3Fxa2wEVr

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sqmapi32.dll	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gjatl.cfg	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gjatl.dll	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gjatl.dll	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4420	1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4420	1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4420	1704	1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\1c918d2f2bb7d7637d461aede42468d2_JaffaCakes118.exe"
  2⤵
  PID:4420

C:\Windows\SysWOW64\sqmapi32.dll

Filesize
9KB

MD5
78455cfbfaee68642935d7f385a8263f

SHA1
151c120e18155874d7ece1e4db9a04bf682169dc

SHA256
041ab48dbefae325d60480c6b8c17c68842a7853ebf04274365b07fa54faf8c2

SHA512
8a9487e3794890699e0b353c9d13e4d0a00913cc900ebf7f7116b6018dac07f08b05902dad5a1df1478a814c9f15ff72b4d9ba973907dafef99f509813171014

Download Submit