Overview

overview

7

Static

static

3

27cc70fd76...18.exe

windows7-x64

7

27cc70fd76...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 07:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    27cc70fd76aec1b41507c7b2f175fc1a_JaffaCakes118.exe

  • Size

    14KB

  • MD5

    27cc70fd76aec1b41507c7b2f175fc1a

  • SHA1

    88f9811ae317f6102947dd048b03eadf0f0f20f7

  • SHA256

    7e48f76fd73effc3040ed8628046e79ee238e2bc36b0a05bacdb1f0cc7287023

  • SHA512

    97df8e005101dbff4286327dadf541e417d9f78e5e7c89d69bda1be431735b7bdb20ca7b42efe74df10c02c03886aa225cc2c5484fb302dc3feaa76f0d51bcde

  • SSDEEP

    384:0HJRQ7FYorgFPVu59v8O9C0OWsRUcKdTAsr:4RQjGPVo890OHFKdZr

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3472
      • C:\Users\Admin\AppData\Local\Temp\27cc70fd76aec1b41507c7b2f175fc1a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\27cc70fd76aec1b41507c7b2f175fc1a_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\27cc70fd76aec1b41507c7b2f175fc1a_JaffaCakes118.exe"
          3⤵
            PID:616

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\SysWOW64\hgfhk.dll
              Filesize

              10KB

              MD5

              98a003317568207ff6b7b29d966a45b2

              SHA1

              31f458c377ddc03b33985abe27e14568a25ef991

              SHA256

              cc8dd14d8039eeafce40b27bfc3e2e23c32878a6e79a0992ff8d932fa13fa64d

              SHA512

              e0682b195b1bc1b1fe37d441b1522e43cfe267d397897d2f1e6ab0a32172897c95a7017b73fce7d4964d967a00c4d44aad088765884b0f04ececd8e236ea986d

              Download Submit

            • memory/3748-6-0x000000000F000000-0x000000000F015000-memory.dmp

              Filesize

              84KB

              Download

            • memory/3748-9-0x000000000F000000-0x000000000F015000-memory.dmp

              Filesize

              84KB

              Download