16a76fa2ecc23f7e30f00e691549ec725bc5c20a15d300994adca8750f8eb446

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe
Size

633KB
MD5

2753dd6b460cec2763025b49193d0ba6
SHA1

819c9b4ce47bef607b0d1ce8cb06e99bb9837463
SHA256

16a76fa2ecc23f7e30f00e691549ec725bc5c20a15d300994adca8750f8eb446
SHA512

29d5ee5fe7e7bf0134ef40ec7c70ccc17af4914ed9972d6de17cf16342cae0cfa5a901ebe22fe4015704dd99c61878fa1a3148bb5ac46b4ef9650ff03e6dd1f2
SSDEEP

12288:HR8Hq5p/+ujnhEI0Xo6qnyxy7ACSdF3Z4mxxX9mOUasGdD:HRWspXjnhh0XMYE7wQmXX9mOUrE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
940	WNET

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\inf\WNET	2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe
File opened for modification	C:\Windows\inf\WNET	2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3844	940	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe
Token: SeDebugPrivilege	940	WNET

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	WNET

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
940	WNET

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 940	2680	2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe	85
PID 2680 wrote to memory of 940	2680	2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe	85
PID 2680 wrote to memory of 940	2680	2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe	85
PID 940 wrote to memory of 4160	940	WNET	86
PID 940 wrote to memory of 4160	940	WNET	86

C:\Users\Admin\AppData\Local\Temp\2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2753dd6b460cec2763025b49193d0ba6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\inf\WNET
  C:\Windows\inf\WNET
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\PRoGRam files\iNtERnEt exPlOrEr\ieXPloRe.eXe
    "C:\PRoGRam files\iNtERnEt exPlOrEr\ieXPloRe.eXe"
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 864
    3⤵
    - Program crash
    PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 940 -ip 940
1⤵
PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\INF\WNET

Filesize
633KB

MD5
2753dd6b460cec2763025b49193d0ba6

SHA1
819c9b4ce47bef607b0d1ce8cb06e99bb9837463

SHA256
16a76fa2ecc23f7e30f00e691549ec725bc5c20a15d300994adca8750f8eb446

SHA512
29d5ee5fe7e7bf0134ef40ec7c70ccc17af4914ed9972d6de17cf16342cae0cfa5a901ebe22fe4015704dd99c61878fa1a3148bb5ac46b4ef9650ff03e6dd1f2

Download Submit
memory/940-76-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2680-0-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2680-1-0x0000000002390000-0x00000000023E4000-memory.dmp

Filesize
336KB

Download
memory/2680-2-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2680-35-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-68-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-36-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-67-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-66-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-65-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-64-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-63-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-62-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-61-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-60-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-59-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-58-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-57-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-56-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-55-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-54-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-53-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-52-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-51-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-50-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-49-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-48-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-47-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-46-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-45-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-44-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-43-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-42-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-41-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-40-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-39-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-38-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-37-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-34-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-33-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-32-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-31-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-30-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-29-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-28-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-27-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-26-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-25-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-24-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-23-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-22-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-21-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-20-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-19-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-18-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-17-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2680-16-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2680-15-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2680-14-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2680-13-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2680-12-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2680-11-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2680-10-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/2680-9-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2680-8-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/2680-7-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2680-6-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2680-5-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/2680-4-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/2680-3-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2680-74-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2680-75-0x0000000002390000-0x00000000023E4000-memory.dmp

Filesize
336KB

Download