6fc0709264338aed596b8f54b7f1c7b58c201cd081ef1aba6114c06918569eab

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
Size

591KB
MD5

24377b2dcde874f463b161afcf4ee876
SHA1

12cbb723fa27c7ee400609fbf4aeeb56a03b67b4
SHA256

6fc0709264338aed596b8f54b7f1c7b58c201cd081ef1aba6114c06918569eab
SHA512

f8b0aff3f47490b90ee653684a57f8f89ec6a6214337d18ef6add0d82f6421fb410bca8f4c8354df3c28ac8fb18db39ac35d6d6253dd576f605da80a7687c462
SSDEEP

12288:U6iDfz9quwmtmlDFOF3Z4mxxVLMmv/8ivmzMGcB7g:U6iDfz9e4QmXV8ivqF4M

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
856	svchost.exe -k

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe -k	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe -k	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	1332	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
Token: SeDebugPrivilege	856	svchost.exe -k

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	svchost.exe -k

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 964	856	svchost.exe -k	81
PID 856 wrote to memory of 964	856	svchost.exe -k	81

C:\Users\Admin\AppData\Local\Temp\24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24377b2dcde874f463b161afcf4ee876_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 712
  2⤵
  - Program crash
  PID:4404

C:\Windows\svchost.exe -k
"C:\Windows\svchost.exe -k"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1332 -ip 1332
1⤵
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe -k

Filesize
591KB

MD5
24377b2dcde874f463b161afcf4ee876

SHA1
12cbb723fa27c7ee400609fbf4aeeb56a03b67b4

SHA256
6fc0709264338aed596b8f54b7f1c7b58c201cd081ef1aba6114c06918569eab

SHA512
f8b0aff3f47490b90ee653684a57f8f89ec6a6214337d18ef6add0d82f6421fb410bca8f4c8354df3c28ac8fb18db39ac35d6d6253dd576f605da80a7687c462

Download Submit
memory/856-44-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/856-43-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1332-27-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-28-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-7-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/1332-6-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1332-5-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/1332-4-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1332-11-0x00000000033A0000-0x0000000003454000-memory.dmp

Filesize
720KB

Download
memory/1332-3-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/1332-2-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/1332-35-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-34-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-33-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-32-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-31-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-30-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-29-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-25-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-0-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1332-8-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1332-26-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-21-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-23-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-22-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-24-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-20-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-19-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-18-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-17-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-16-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-15-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-14-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-13-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1332-12-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/1332-9-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1332-40-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1332-41-0x0000000000920000-0x0000000000974000-memory.dmp

Filesize
336KB

Download
memory/1332-42-0x00000000033A0000-0x00000000033A6000-memory.dmp

Filesize
24KB

Download
memory/1332-10-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1332-1-0x0000000000920000-0x0000000000974000-memory.dmp

Filesize
336KB

Download