c4596f28e6dd48ce82ced792b2adc95a3bb2879a13355516ad9f110e7babef11

Analysis

max time kernel
62s
max time network
62s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe
Size

30KB
MD5

323bff356b4e7b8bea54c059f8752c4f
SHA1

b004e2fc1404825abaa828cc598e7b1ce270e622
SHA256

c4596f28e6dd48ce82ced792b2adc95a3bb2879a13355516ad9f110e7babef11
SHA512

c6119b8688a7cc01a5fa96ea5bea23f3c31e4a53ae87cdc45618eeef3c96a41562aea124dcdd36c87fa4a6839c9cf39c5e939cd858acdaee93d73b0f6d791865
SSDEEP

768:0ThCxie7h1WAyb8E1f7JdRgC+d44WgMJbOZOblDOIR9dt8vGbY:0ThCEe3WFIE1fHk1MJ6ZOblDOItt8vGU

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\usbKeyInit.sys	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\knlExt.dll	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2324	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe
2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe
2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2644	2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe	32
PID 2324 wrote to memory of 2644	2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe	32
PID 2324 wrote to memory of 2644	2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe	32
PID 2324 wrote to memory of 2644	2324	323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\323bff356b4e7b8bea54c059f8752c4f_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 260
  2⤵
  - Program crash
  PID:2644

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2624

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\knlExt.dll

Filesize
2KB

MD5
85aafcf391caa4bdfa1d13fef9311fbe

SHA1
625053d7c466597c6676c0af458e3521334ec2c1

SHA256
e60044a31e6ec7bf8640b03c50fa3c972ae8a173806c2ed6d73259d80985d2b0

SHA512
a213dad47ba7fd04a6dbcf052374df1ac8639ec73bf74cd864f8be56352c4c0129a60bae2ae86e9b5ecacf614c0fb68c9591100bb69a2a64da76dc8cd8faf419

Download Submit
memory/756-7-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2324-4-0x0000000011000000-0x000000001100C000-memory.dmp

Filesize
48KB

Download
memory/2624-6-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download