6e90adc9bf3afbc2d2aaf31fa63daa5b4afe717ab0e0c14b0047c78ba80eef7f

Analysis

max time kernel
143s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:42

Target

2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
Size

279KB
MD5

2a8c2062d2070a54dd987ff386ec2e22
SHA1

afe87262b97e9abdc9a6591bc328318bbf6c030c
SHA256

6e90adc9bf3afbc2d2aaf31fa63daa5b4afe717ab0e0c14b0047c78ba80eef7f
SHA512

40b88ba69968dc79edeb492321ccc284e8fc3a34550df1693986a297153f1e0ba0c64d3db65389cd15bce8139c2d00f700c03fac53f0031ea71ba0634bd59508
SSDEEP

6144:kn/qK5+ew5TnGjQN5ns8TPIXInvDeQcWBkpFK/ngMoaifdv:O/UFVGa5nsaAXIvRIFK/Hi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1916	L_Server2.03.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\L_Server2.03.exe	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
File opened for modification	C:\Windows\L_Server2.03.exe	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
File created	C:\Windows\DELME.BAT	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
Token: SeDebugPrivilege	1916	L_Server2.03.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	L_Server2.03.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2004	1916	L_Server2.03.exe	93
PID 1916 wrote to memory of 2004	1916	L_Server2.03.exe	93
PID 4224 wrote to memory of 4084	4224	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	95
PID 4224 wrote to memory of 4084	4224	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	95
PID 4224 wrote to memory of 4084	4224	2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a8c2062d2070a54dd987ff386ec2e22_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\DELME.BAT
  2⤵
  PID:4084

C:\Windows\L_Server2.03.exe
C:\Windows\L_Server2.03.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4624,i,10426317566413639638,17907471819827662535,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:3168

C:\Windows\DELME.BAT

Filesize
218B

MD5
06d107154a882e3897a8df9278fbde44

SHA1
198d1a17ebd296763893cb3cd93dadcf9c2bae74

SHA256
dffc6f4007c68444e8919c635233587b0c65f3ab84d4e02178a35cef222c0491

SHA512
893d14a213891e42cc59d9c73477c70b66589d656b6f2e0b9d4a4d0f6597230fd0a551aa0a9dfa5355f1a1a1696c9ca975e8a088bdb57e9a127dd8e707ae5521

Download Submit
C:\Windows\L_Server2.03.exe

Filesize
279KB

MD5
2a8c2062d2070a54dd987ff386ec2e22

SHA1
afe87262b97e9abdc9a6591bc328318bbf6c030c

SHA256
6e90adc9bf3afbc2d2aaf31fa63daa5b4afe717ab0e0c14b0047c78ba80eef7f

SHA512
40b88ba69968dc79edeb492321ccc284e8fc3a34550df1693986a297153f1e0ba0c64d3db65389cd15bce8139c2d00f700c03fac53f0031ea71ba0634bd59508

Download Submit
memory/1916-6-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1916-11-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1916-13-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/4224-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/4224-1-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/4224-9-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download