b3e60b276c70ad9795d149edaae19f67718dfd22beda2ccc8cd8ed9ef9281125

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 14:10

Target

26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe
Size

30KB
MD5

26f6b3d4cfd885e6be9519b4b93698da
SHA1

295c5d995323c41426f34b3fd074e55b66a94a17
SHA256

b3e60b276c70ad9795d149edaae19f67718dfd22beda2ccc8cd8ed9ef9281125
SHA512

49de1f2149727b770f194a7ab6ae1bbc48c5e1f6ec99e5288a25a5c85b04c2a900d741f524c25572e72b2b6973efa5421b5d7c0668047687f10cbb1ab5e3edbe
SSDEEP

384:xoGOuBoKjkcCrBnkbRxJK7SThq38HDIWbEd/cbH6olytd4NBNXKXu8Ett8/Qq8R:eH9BkQ8HTJH7QD4NnMvG8/Q1

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2440	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1792	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1596	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2440	1596	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe	31
PID 1596 wrote to memory of 2440	1596	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe	31
PID 1596 wrote to memory of 2440	1596	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe	31
PID 1596 wrote to memory of 2440	1596	26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\26F6B3~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2440

C:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe
C:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe

Filesize
30KB

MD5
26f6b3d4cfd885e6be9519b4b93698da

SHA1
295c5d995323c41426f34b3fd074e55b66a94a17

SHA256
b3e60b276c70ad9795d149edaae19f67718dfd22beda2ccc8cd8ed9ef9281125

SHA512
49de1f2149727b770f194a7ab6ae1bbc48c5e1f6ec99e5288a25a5c85b04c2a900d741f524c25572e72b2b6973efa5421b5d7c0668047687f10cbb1ab5e3edbe

Download Submit
memory/1596-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1596-1-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1596-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1792-5-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1792-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1792-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1792-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download