05aaf2d4855f765e016ad7fb7d55531cc6f03a5b7b31553aa81d7cea6c4597cd

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:20

Target

31a65114299c4405949acd4858778934_JaffaCakes118.exe
Size

81KB
MD5

31a65114299c4405949acd4858778934
SHA1

9f09f4d6e61bac7d547cda9cc1c66d88df0020d5
SHA256

05aaf2d4855f765e016ad7fb7d55531cc6f03a5b7b31553aa81d7cea6c4597cd
SHA512

430d87aa28263ca94c16aec2803f73691727bf4f8bfac6d95e3ef7342dd64b3201b94aef88fd666f4d4800078bce2be70b2da0ab3109014ec8d07463153f6142
SSDEEP

1536:jKDPPTHbuzvZPtXjVaAZbBh8WconV1NNwYGO7ZCuWJ1lOIhsOV8Q62/do:jqPPTHKzRlVaAZtcGV1NNweWJ17em8Qe

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1980	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
820	IUkC0s0m.exe

Loads dropped DLL 2 IoCs

pid	Process
2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe
2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2692-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2692-6-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/820-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-17.dat	upx
behavioral1/memory/820-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/820-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IUkC0s0m.exe.a_a	IUkC0s0m.exe
File created	C:\Windows\SysWOW64\IUkC0s0m.exe	31a65114299c4405949acd4858778934_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IUkC0s0m.exe	31a65114299c4405949acd4858778934_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 820	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	32
PID 2692 wrote to memory of 820	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	32
PID 2692 wrote to memory of 820	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	32
PID 2692 wrote to memory of 820	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	32
PID 2692 wrote to memory of 1980	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	33
PID 2692 wrote to memory of 1980	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	33
PID 2692 wrote to memory of 1980	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	33
PID 2692 wrote to memory of 1980	2692	31a65114299c4405949acd4858778934_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\31a65114299c4405949acd4858778934_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31a65114299c4405949acd4858778934_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\IUkC0s0m.exe
  "C:\Windows\system32\IUkC0s0m.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\31A651~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1980

C:\Windows\SysWOW64\IUkC0s0m.exe

Filesize
81KB

MD5
31a65114299c4405949acd4858778934

SHA1
9f09f4d6e61bac7d547cda9cc1c66d88df0020d5

SHA256
05aaf2d4855f765e016ad7fb7d55531cc6f03a5b7b31553aa81d7cea6c4597cd

SHA512
430d87aa28263ca94c16aec2803f73691727bf4f8bfac6d95e3ef7342dd64b3201b94aef88fd666f4d4800078bce2be70b2da0ab3109014ec8d07463153f6142

Download Submit
memory/820-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/820-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/820-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2692-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2692-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2692-6-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download