6e90adc9bf3afbc2d2aaf31fa63daa5b4afe717ab0e0c14b0047c78ba80eef7f

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 01:42

Target

2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
Size

279KB
MD5

2a8c2062d2070a54dd987ff386ec2e22
SHA1

afe87262b97e9abdc9a6591bc328318bbf6c030c
SHA256

6e90adc9bf3afbc2d2aaf31fa63daa5b4afe717ab0e0c14b0047c78ba80eef7f
SHA512

40b88ba69968dc79edeb492321ccc284e8fc3a34550df1693986a297153f1e0ba0c64d3db65389cd15bce8139c2d00f700c03fac53f0031ea71ba0634bd59508
SSDEEP

6144:kn/qK5+ew5TnGjQN5ns8TPIXInvDeQcWBkpFK/ngMoaifdv:O/UFVGa5nsaAXIvRIFK/Hi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2684	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1460	L_Server2.03.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\L_Server2.03.exe	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
File opened for modification	C:\Windows\L_Server2.03.exe	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
File created	C:\Windows\DELME.BAT	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
Token: SeDebugPrivilege	1460	L_Server2.03.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1460	L_Server2.03.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2256	1460	L_Server2.03.exe	29
PID 1460 wrote to memory of 2256	1460	L_Server2.03.exe	29
PID 1460 wrote to memory of 2256	1460	L_Server2.03.exe	29
PID 1460 wrote to memory of 2256	1460	L_Server2.03.exe	29
PID 2112 wrote to memory of 2684	2112	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2684	2112	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2684	2112	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2684	2112	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\DELME.BAT
  2⤵
  - Deletes itself
  PID:2684

C:\Windows\L_Server2.03.exe
C:\Windows\L_Server2.03.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2256

C:\Windows\DELME.BAT

Filesize
218B

MD5
06d107154a882e3897a8df9278fbde44

SHA1
198d1a17ebd296763893cb3cd93dadcf9c2bae74

SHA256
dffc6f4007c68444e8919c635233587b0c65f3ab84d4e02178a35cef222c0491

SHA512
893d14a213891e42cc59d9c73477c70b66589d656b6f2e0b9d4a4d0f6597230fd0a551aa0a9dfa5355f1a1a1696c9ca975e8a088bdb57e9a127dd8e707ae5521

Download Submit
C:\Windows\L_Server2.03.exe

Filesize
279KB

MD5
2a8c2062d2070a54dd987ff386ec2e22

SHA1
afe87262b97e9abdc9a6591bc328318bbf6c030c

SHA256
6e90adc9bf3afbc2d2aaf31fa63daa5b4afe717ab0e0c14b0047c78ba80eef7f

SHA512
40b88ba69968dc79edeb492321ccc284e8fc3a34550df1693986a297153f1e0ba0c64d3db65389cd15bce8139c2d00f700c03fac53f0031ea71ba0634bd59508

Download Submit
memory/1460-5-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1460-6-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1460-17-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1460-19-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2112-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2112-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2112-15-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download