165c49439517cd926d88bab4baad847d8a9478ca1b1b797313a45f3df2e36fe8

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 23:51

Target

23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe
Size

27KB
MD5

23e8813fda16b15ab8cb1a6d6d8e9321
SHA1

d7fdb7f02c4335379bd59e6a4975840a171c3ffc
SHA256

165c49439517cd926d88bab4baad847d8a9478ca1b1b797313a45f3df2e36fe8
SHA512

7a81c8d966eef73ff07f27241ba6670098ede5403ea5b5a10b4b6dedb5c38c19cfe8ad61cecacdf0781a514b9253711b08287b73e1b74d832597e7f47aa9bfe4
SSDEEP

384:pVxTRFQgvnthOgXeH0Op475UtvzlnOKeekp2kX5dTDi6StFl4fGffXK2bH43xUgc:LxTbOgOUx+t9OKapZ5NZfM5bAYEiI9I

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1372	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\imm32.dll	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\imm32.dll	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe
2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe
2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe
2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1372	2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe	28
PID 2336 wrote to memory of 1372	2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe	28
PID 2336 wrote to memory of 1372	2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe	28
PID 2336 wrote to memory of 1372	2336	23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\23e8813fda16b15ab8cb1a6d6d8e9321_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:1372

memory/2336-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download