a906a4305a1e7458d14ae876936a4999570507d6a81bfa7c8dbb3878420edccf

Analysis

max time kernel
149s
max time network
161s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 13:36

Target

2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
Size

23KB
MD5

2c8d5468b85a22a0ff4cf397d13ecd48
SHA1

6a0a995fc451edad2013dc9f1046727118ccecfc
SHA256

a906a4305a1e7458d14ae876936a4999570507d6a81bfa7c8dbb3878420edccf
SHA512

86cebc84f0ba6e4b5b18ae463f983bef757f96875e34f5384f16aa8033fc5a9417dc530586cb07f772bb5685eac131ebaf3ba3abeeb29ac72dde2da9f08981c8
SSDEEP

384:U9bx7AD8fCPGFPOnpxKGF1vvB7JktvqVrz3zirke7u2BDkBQS:ON7a8pFPOB1vvXMvqtzWrkeayDi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2996	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1920	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2996	2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2996	2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2996	2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2996	2248	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2C8D54~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2996

C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Filesize
23KB

MD5
2c8d5468b85a22a0ff4cf397d13ecd48

SHA1
6a0a995fc451edad2013dc9f1046727118ccecfc

SHA256
a906a4305a1e7458d14ae876936a4999570507d6a81bfa7c8dbb3878420edccf

SHA512
86cebc84f0ba6e4b5b18ae463f983bef757f96875e34f5384f16aa8033fc5a9417dc530586cb07f772bb5685eac131ebaf3ba3abeeb29ac72dde2da9f08981c8

Download Submit
memory/1920-5-0x0000000000400000-0x00000000004495F0-memory.dmp

Filesize
293KB

Download
memory/2248-0-0x0000000000400000-0x00000000004495F0-memory.dmp

Filesize
293KB

Download
memory/2248-1-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2248-4-0x0000000000400000-0x00000000004495F0-memory.dmp

Filesize
293KB

Download