94e21f29aeadfd970d3c40396f3c68cdbdc5e5af557cd56a1c145b74dcb24a4d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28fff2d1853d023933974089531d619e_JaffaCakes118.exe
Size

893KB
MD5

28fff2d1853d023933974089531d619e
SHA1

9d5d771d1cfa84f235b4c70cd84bb1c0a0fc5899
SHA256

94e21f29aeadfd970d3c40396f3c68cdbdc5e5af557cd56a1c145b74dcb24a4d
SHA512

c84e7af80a2025efc5a2150d398506263c0de6a6fbcedc06554c86597c8993102d745efcda8b979a9c06260851769f9e180d5216062627d5f64480e4627395ba
SSDEEP

24576:KP39U18bHTcXSWV+jpONcK5ldt1pdJuY:T8rIXSxpccK5lH1T

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe
2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2696	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2696	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2696	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2696	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2516	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2516	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2516	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2516	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2368	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	33
PID 2520 wrote to memory of 2368	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	33
PID 2520 wrote to memory of 2368	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	33
PID 2520 wrote to memory of 2368	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	33
PID 2520 wrote to memory of 2268	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	34
PID 2520 wrote to memory of 2268	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	34
PID 2520 wrote to memory of 2268	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	34
PID 2520 wrote to memory of 2268	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	34
PID 2520 wrote to memory of 2688	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	35
PID 2520 wrote to memory of 2688	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	35
PID 2520 wrote to memory of 2688	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	35
PID 2520 wrote to memory of 2688	2520	28fff2d1853d023933974089531d619e_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe"
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe"
  2⤵
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe"
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe"
  2⤵
  PID:2268
- C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\28fff2d1853d023933974089531d619e_JaffaCakes118.exe"
  2⤵
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

Filesize
4KB

Download
memory/2520-1-0x0000000000350000-0x0000000000436000-memory.dmp

Filesize
920KB

Download
memory/2520-2-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-3-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2520-4-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

Filesize
4KB

Download
memory/2520-5-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-6-0x00000000044D0000-0x0000000004522000-memory.dmp

Filesize
328KB

Download
memory/2520-7-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download