2fe1c627d229e955ba9d0fbb78872c3b58a65a6f7a2df6994fa6e41bfca5b645

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 16:23

Target

2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe
Size

745KB
MD5

2d02d0c50c259860a3b531a2cec54324
SHA1

22226e142c5dcd6d3cf1f00756e34ea9af7adf04
SHA256

2fe1c627d229e955ba9d0fbb78872c3b58a65a6f7a2df6994fa6e41bfca5b645
SHA512

f831569ea29d9bbc2ddbc4d8c723477aedac8482f89956da2ebd90ad88ad3f5d4402e22ec0d80f3efee751981807b822adecb70b29472ac89643ca2faac14e43
SSDEEP

12288:8d8jpNSpwmYMCZqqlLbQs637fP0JJZ2dJpQViaY0cTM57vshARifHMP6qrXoo7fP:8qN8wbcql3Qs637fP0JiJpQHcTMp0hAl

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4440	explorer.dll

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\explorer.dll	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe
File opened for modification	C:\Windows\explorer.dll	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe
Token: SeDebugPrivilege	4440	explorer.dll

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4440	explorer.dll

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2576	3908	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe	94
PID 3908 wrote to memory of 2576	3908	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe	94
PID 3908 wrote to memory of 2576	3908	2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe	94
PID 4440 wrote to memory of 400	4440	explorer.dll	93
PID 4440 wrote to memory of 400	4440	explorer.dll	93

C:\Users\Admin\AppData\Local\Temp\2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d02d0c50c259860a3b531a2cec54324_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:2576

C:\Windows\explorer.dll
C:\Windows\explorer.dll
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1028,i,16032378445269040051,10701855434060315937,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:3296

C:\Windows\explorer.dll

Filesize
745KB

MD5
2d02d0c50c259860a3b531a2cec54324

SHA1
22226e142c5dcd6d3cf1f00756e34ea9af7adf04

SHA256
2fe1c627d229e955ba9d0fbb78872c3b58a65a6f7a2df6994fa6e41bfca5b645

SHA512
f831569ea29d9bbc2ddbc4d8c723477aedac8482f89956da2ebd90ad88ad3f5d4402e22ec0d80f3efee751981807b822adecb70b29472ac89643ca2faac14e43

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
8d7adc390937910066e638bb0aa83f70

SHA1
0d337d5172c469f7de548529617c3a9fc7758ac0

SHA256
da2a8b9821a685bacda9820dc1f6be414847d11d8463f56bdca603efdb9d7b84

SHA512
1a536798f8f53ab5489a40f68c0cae5fb2db353cc0bcbc1ad2155f450f0c4c0ab3ce4ccf60e4af5ab7289e56e6c5927039ca66bb915b0b229252ff1aa535c32e

Download Submit
memory/3908-0-0x0000000000400000-0x00000000004C305F-memory.dmp

Filesize
780KB

Download
memory/3908-1-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/3908-10-0x0000000000400000-0x00000000004C305F-memory.dmp

Filesize
780KB

Download
memory/4440-8-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/4440-12-0x0000000000400000-0x00000000004C305F-memory.dmp

Filesize
780KB

Download
memory/4440-13-0x0000000000400000-0x00000000004C305F-memory.dmp

Filesize
780KB

Download
memory/4440-14-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/4440-18-0x0000000000400000-0x00000000004C305F-memory.dmp

Filesize
780KB

Download