f6689837387ea507298a7dc617cd0262307e3200b4af2118c88aad3176879f2b

Analysis

max time kernel
146s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 02:19

Target

32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe
Size

19KB
MD5

32f166466d76d3420930ac844adf33e4
SHA1

eb787b439646b8155a71e5be4008007108526229
SHA256

f6689837387ea507298a7dc617cd0262307e3200b4af2118c88aad3176879f2b
SHA512

c9feaf302df13d474b0385c0799d6c74af5d215292746a0f30b42ae12b03c9186d2a9c2ba3c444abc555c836da936e9e0903fd5eb8712415061b8351047def8a
SSDEEP

384:jtqlrtUAi1in5mBPiSTBC+KnMiKVMZwm78oxXLf3TC+:pqlPeino/0NnM+RxXLf32

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2276	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1340	wmiprvxe.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1700-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x000e000000012025-2.dat	upx
behavioral1/memory/1340-3-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/1700-4-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/1340-5-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmiprvxe.exe	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wmiprvxe.exe	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1700	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2276	1700	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe	32
PID 1700 wrote to memory of 2276	1700	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe	32
PID 1700 wrote to memory of 2276	1700	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe	32
PID 1700 wrote to memory of 2276	1700	32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32f166466d76d3420930ac844adf33e4_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\32F166~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2276

C:\Windows\SysWOW64\wmiprvxe.exe
C:\Windows\SysWOW64\wmiprvxe.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\SysWOW64\wmiprvxe.exe

Filesize
19KB

MD5
32f166466d76d3420930ac844adf33e4

SHA1
eb787b439646b8155a71e5be4008007108526229

SHA256
f6689837387ea507298a7dc617cd0262307e3200b4af2118c88aad3176879f2b

SHA512
c9feaf302df13d474b0385c0799d6c74af5d215292746a0f30b42ae12b03c9186d2a9c2ba3c444abc555c836da936e9e0903fd5eb8712415061b8351047def8a

Download Submit
memory/1340-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1340-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1700-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1700-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download