6fc0709264338aed596b8f54b7f1c7b58c201cd081ef1aba6114c06918569eab

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
Size

591KB
MD5

24377b2dcde874f463b161afcf4ee876
SHA1

12cbb723fa27c7ee400609fbf4aeeb56a03b67b4
SHA256

6fc0709264338aed596b8f54b7f1c7b58c201cd081ef1aba6114c06918569eab
SHA512

f8b0aff3f47490b90ee653684a57f8f89ec6a6214337d18ef6add0d82f6421fb410bca8f4c8354df3c28ac8fb18db39ac35d6d6253dd576f605da80a7687c462
SSDEEP

12288:U6iDfz9quwmtmlDFOF3Z4mxxVLMmv/8ivmzMGcB7g:U6iDfz9e4QmXV8ivqF4M

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2596	svchost.exe -k

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe -k	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe -k	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	2868	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
Token: SeDebugPrivilege	2596	svchost.exe -k

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	svchost.exe -k

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2600	2596	svchost.exe -k	29
PID 2596 wrote to memory of 2600	2596	svchost.exe -k	29
PID 2596 wrote to memory of 2600	2596	svchost.exe -k	29
PID 2596 wrote to memory of 2600	2596	svchost.exe -k	29
PID 2868 wrote to memory of 2560	2868	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2560	2868	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2560	2868	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2560	2868	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 376
  2⤵
  - Program crash
  PID:2560

C:\Windows\svchost.exe -k
"C:\Windows\svchost.exe -k"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe -k

Filesize
591KB

MD5
24377b2dcde874f463b161afcf4ee876

SHA1
12cbb723fa27c7ee400609fbf4aeeb56a03b67b4

SHA256
6fc0709264338aed596b8f54b7f1c7b58c201cd081ef1aba6114c06918569eab

SHA512
f8b0aff3f47490b90ee653684a57f8f89ec6a6214337d18ef6add0d82f6421fb410bca8f4c8354df3c28ac8fb18db39ac35d6d6253dd576f605da80a7687c462

Download Submit
memory/2596-46-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/2596-49-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/2868-0-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/2868-1-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/2868-38-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-35-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-39-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-40-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-36-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-37-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-34-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-33-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-32-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-31-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-30-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-29-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-28-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-27-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-26-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-25-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-24-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-23-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-22-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-21-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-20-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-19-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-18-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-17-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-16-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-15-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-14-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-13-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-12-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-11-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-10-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/2868-9-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2868-8-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2868-7-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2868-6-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/2868-5-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/2868-4-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2868-3-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/2868-2-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2868-42-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/2868-41-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-48-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/2868-50-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/2868-69-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-73-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-74-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-72-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-71-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-70-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-75-0x0000000003280000-0x0000000003334000-memory.dmp

Filesize
720KB

Download
memory/2868-68-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-67-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-66-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-65-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-64-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-63-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-62-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-61-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-60-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-59-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2868-58-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-57-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-56-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-55-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-54-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-53-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-52-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2868-77-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download