a906a4305a1e7458d14ae876936a4999570507d6a81bfa7c8dbb3878420edccf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 13:36

Target

2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
Size

23KB
MD5

2c8d5468b85a22a0ff4cf397d13ecd48
SHA1

6a0a995fc451edad2013dc9f1046727118ccecfc
SHA256

a906a4305a1e7458d14ae876936a4999570507d6a81bfa7c8dbb3878420edccf
SHA512

86cebc84f0ba6e4b5b18ae463f983bef757f96875e34f5384f16aa8033fc5a9417dc530586cb07f772bb5685eac131ebaf3ba3abeeb29ac72dde2da9f08981c8
SSDEEP

384:U9bx7AD8fCPGFPOnpxKGF1vvB7JktvqVrz3zirke7u2BDkBQS:ON7a8pFPOB1vvXMvqtzWrkeayDi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2216	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3128	1076	WerFault.exe	79
1288	2216	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4520	1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	89
PID 1076 wrote to memory of 4520	1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	89
PID 1076 wrote to memory of 4520	1076	2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 220
  2⤵
  - Program crash
  PID:3128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2C8D54~1.EXE > nul
  2⤵
  PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1076 -ip 1076
1⤵
PID:2400

C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe
1⤵
- Executes dropped EXE
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 216
  2⤵
  - Program crash
  PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2216 -ip 2216
1⤵
PID:3860

C:\Windows\SysWOW64\2c8d5468b85a22a0ff4cf397d13ecd48_JaffaCakes118.exe

Filesize
23KB

MD5
2c8d5468b85a22a0ff4cf397d13ecd48

SHA1
6a0a995fc451edad2013dc9f1046727118ccecfc

SHA256
a906a4305a1e7458d14ae876936a4999570507d6a81bfa7c8dbb3878420edccf

SHA512
86cebc84f0ba6e4b5b18ae463f983bef757f96875e34f5384f16aa8033fc5a9417dc530586cb07f772bb5685eac131ebaf3ba3abeeb29ac72dde2da9f08981c8

Download Submit
memory/1076-0-0x0000000000400000-0x00000000004495F0-memory.dmp

Filesize
293KB

Download
memory/1076-1-0x00000000005C0000-0x00000000005C9000-memory.dmp

Filesize
36KB

Download
memory/1076-6-0x0000000000400000-0x00000000004495F0-memory.dmp

Filesize
293KB

Download
memory/2216-5-0x0000000000D10000-0x0000000000D19000-memory.dmp

Filesize
36KB

Download
memory/2216-7-0x0000000000400000-0x00000000004495F0-memory.dmp

Filesize
293KB

Download