Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 19:20
Behavioral task
behavioral1
Sample
31a65114299c4405949acd4858778934_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
31a65114299c4405949acd4858778934_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
31a65114299c4405949acd4858778934_JaffaCakes118.exe
-
Size
81KB
-
MD5
31a65114299c4405949acd4858778934
-
SHA1
9f09f4d6e61bac7d547cda9cc1c66d88df0020d5
-
SHA256
05aaf2d4855f765e016ad7fb7d55531cc6f03a5b7b31553aa81d7cea6c4597cd
-
SHA512
430d87aa28263ca94c16aec2803f73691727bf4f8bfac6d95e3ef7342dd64b3201b94aef88fd666f4d4800078bce2be70b2da0ab3109014ec8d07463153f6142
-
SSDEEP
1536:jKDPPTHbuzvZPtXjVaAZbBh8WconV1NNwYGO7ZCuWJ1lOIhsOV8Q62/do:jqPPTHKzRlVaAZtcGV1NNweWJ17em8Qe
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1980 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 820 IUkC0s0m.exe -
Loads dropped DLL 2 IoCs
pid Process 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2692-1-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2692-6-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/820-19-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0004000000004ed7-17.dat upx behavioral1/memory/820-20-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/820-25-0x0000000000400000-0x0000000000423000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\IUkC0s0m.exe.a_a IUkC0s0m.exe File created C:\Windows\SysWOW64\IUkC0s0m.exe 31a65114299c4405949acd4858778934_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IUkC0s0m.exe 31a65114299c4405949acd4858778934_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2692 wrote to memory of 820 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 32 PID 2692 wrote to memory of 820 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 32 PID 2692 wrote to memory of 820 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 32 PID 2692 wrote to memory of 820 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 32 PID 2692 wrote to memory of 1980 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 33 PID 2692 wrote to memory of 1980 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 33 PID 2692 wrote to memory of 1980 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 33 PID 2692 wrote to memory of 1980 2692 31a65114299c4405949acd4858778934_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a65114299c4405949acd4858778934_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31a65114299c4405949acd4858778934_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\IUkC0s0m.exe"C:\Windows\system32\IUkC0s0m.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:820
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\31A651~1.EXE > nul2⤵
- Deletes itself
PID:1980
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD531a65114299c4405949acd4858778934
SHA19f09f4d6e61bac7d547cda9cc1c66d88df0020d5
SHA25605aaf2d4855f765e016ad7fb7d55531cc6f03a5b7b31553aa81d7cea6c4597cd
SHA512430d87aa28263ca94c16aec2803f73691727bf4f8bfac6d95e3ef7342dd64b3201b94aef88fd666f4d4800078bce2be70b2da0ab3109014ec8d07463153f6142