928063c58a02fbf5678943ad3c9547b6a38246cbbc87403df0460c83f34b6baa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe
Size

384KB
MD5

246a30f86b6c97e82db6bff3f5da52af
SHA1

cdc195d839f2f3a34737430c3f6ce9c0d158e7de
SHA256

928063c58a02fbf5678943ad3c9547b6a38246cbbc87403df0460c83f34b6baa
SHA512

aecefa1e9b5665e400f49adf34f61d02a1366f188fd935edadfd1e3c96abd83abb2862b6a8bd5c105264c10262b46855cf9d84c44e2dce840e4d230a8ad893be
SSDEEP

6144:GHXOWGbq5CpzMOkF2idZecnl20lHRxp3g+eTk8/rY016oJwgvfZB2Djs8:LWYI9F3Z4mxxJeA800DzvzE

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Swz11.dll	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Swz50.bat	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 432	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe	5
PID 1804 wrote to memory of 432	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe	5
PID 1804 wrote to memory of 2744	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe	28
PID 1804 wrote to memory of 2744	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe	28
PID 1804 wrote to memory of 2744	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe	28
PID 1804 wrote to memory of 2744	1804	246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe	28

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\System32\Swz50.bat C:\Users\Admin\AppData\Local\Temp\246a30f86b6c97e82db6bff3f5da52af_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Swz50.bat

Filesize
97B

MD5
5c42d51c8d55e052a33858f619a7e32f

SHA1
552e104cb74176939426d5ae598f73aa7aa4da74

SHA256
5ec55568de43a645657da3a0ed1600c1b77af4332279a3da723b1c0e3e4cc8df

SHA512
2ced1365511d394fa8d01c357c76f0e4d7cb0e150b53b0d664448fa6640b6fc172f708d2768cfe09c8776afd40e76856f34c5283b2027a837647367cc1319ef8

Download Submit
memory/432-36-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/432-38-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/1804-32-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1804-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-27-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/1804-31-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1804-25-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1804-24-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1804-23-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1804-22-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1804-21-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/1804-20-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/1804-19-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1804-18-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/1804-17-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1804-16-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/1804-35-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/1804-34-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/1804-33-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/1804-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-26-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1804-28-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1804-14-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1804-15-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1804-13-0x0000000003190000-0x0000000003192000-memory.dmp

Filesize
8KB

Download
memory/1804-12-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1804-11-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/1804-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1804-7-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1804-6-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1804-5-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1804-4-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1804-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1804-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1804-29-0x00000000031E0000-0x0000000003220000-memory.dmp

Filesize
256KB

Download
memory/1804-9-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/1804-1-0x0000000000310000-0x0000000000364000-memory.dmp

Filesize
336KB

Download
memory/1804-30-0x00000000031E0000-0x0000000003220000-memory.dmp

Filesize
256KB

Download
memory/1804-49-0x0000000000310000-0x0000000000364000-memory.dmp

Filesize
336KB

Download