05b0d4e7013bbe9c67422125c386fffe9e4c25999971b77cbebe6c0509d00810

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 23:19

Target

36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
Size

49KB
MD5

36cd6d1166a61a53071502404b7fada0
SHA1

a3b09e2757d33ebeb54a874e5e736692bd409cbe
SHA256

05b0d4e7013bbe9c67422125c386fffe9e4c25999971b77cbebe6c0509d00810
SHA512

e2b7abaabd07dbec884c9ee84ec360024bac1ea6737a124bd873e0846e97be994db2ba0bc1ccb3ec72ba64c8a45725c75b35b8ffac8476e5c27f69f1627b7ee1
SSDEEP

768:lF9YeWOCwUGZKqP2gfcOubcZWGk06hHgwKU7S9J8B3pvDCRNHIi99VziFt:79AOCrOjukW6cS9g5vInyF

Score

7^/10

upx

Loads dropped DLL 2 IoCs

pid	Process
4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4600-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4600-19-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fjvurl1.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fjvurl1.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fjvurl3.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fjvurl4.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fjvurl5.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fjvurl2.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fjvurl2.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fjvurl3.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fjvurl4.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fjvurl5.dat	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\bvkexd\fzonkvxyq.dll	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3232	4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe	83
PID 4600 wrote to memory of 3232	4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe	83
PID 4600 wrote to memory of 3232	4600	36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36cd6d1166a61a53071502404b7fada0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\36CD6D~1.EXE
  2⤵
  PID:3232

C:\Program Files\bvkexd\fzonkvxyq.dll

Filesize
64KB

MD5
1f0fafd1ef00d66c09c0dc9494995f7b

SHA1
400f49ea72b67c78c1e7e5ad839fd11aea7197e9

SHA256
ad71ac42eafcdbbc52185dab9511f11a0300be75741409b0398f78f77fe4271f

SHA512
1d383f6a5a98d664b45649a8b96008955faac6c2cec7ab6fb1d8c47d87ad4790ff4928b322a669a5234e71018294c258920baddc03b886c44ef07348aeee06e2

Download Submit
memory/4600-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4600-14-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/4600-17-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/4600-19-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download