c2162af2ea87f6a82762ec32395441cd219ded51d3c3bff143d85fff49c1cb70

Analysis

max time kernel
143s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 06:51

Target

33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe
Size

346KB
MD5

33bb060d358a4de462c582ffe158f442
SHA1

695d4c90bea1270b4949484447b1209b2e49c6c9
SHA256

c2162af2ea87f6a82762ec32395441cd219ded51d3c3bff143d85fff49c1cb70
SHA512

15c3ea1f13362b30d31a400592e51eeeb22d1edf322d4e83951b027a5411375706a85bd2b0bb7961bd7aa6386d9bedde8d548c13a0a93a537e170137c097094e
SSDEEP

6144:QwwldYMYnNYGRcrbFZMe6+Ga/Rr4HZtREaHg8KkoFj7jmGy3a7:QwgdYBnNYGRWbAe61Ur4HZEaHgf9jkQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1036	Hacker.com.cn.ini

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.ini	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.ini	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Hacker.com.cn.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Hacker.com.cn.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Hacker.com.cn.ini
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Hacker.com.cn.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Hacker.com.cn.ini

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe
Token: SeDebugPrivilege	1036	Hacker.com.cn.ini

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1036	Hacker.com.cn.ini

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4408	1036	Hacker.com.cn.ini	85
PID 1036 wrote to memory of 4408	1036	Hacker.com.cn.ini	85
PID 112 wrote to memory of 4684	112	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe	86
PID 112 wrote to memory of 4684	112	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe	86
PID 112 wrote to memory of 4684	112	33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33bb060d358a4de462c582ffe158f442_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4684

C:\Windows\Hacker.com.cn.ini
C:\Windows\Hacker.com.cn.ini
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4408

C:\Windows\Hacker.com.cn.ini

Filesize
346KB

MD5
33bb060d358a4de462c582ffe158f442

SHA1
695d4c90bea1270b4949484447b1209b2e49c6c9

SHA256
c2162af2ea87f6a82762ec32395441cd219ded51d3c3bff143d85fff49c1cb70

SHA512
15c3ea1f13362b30d31a400592e51eeeb22d1edf322d4e83951b027a5411375706a85bd2b0bb7961bd7aa6386d9bedde8d548c13a0a93a537e170137c097094e

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
88b4fd1db1157d562abdf06fa49dd71e

SHA1
88dbb415bad256311bcf2dfa81e7288d767ba874

SHA256
5f5b35dcf7b28f197adaf8929e0b87252a12b399b16a3aadece6e8d99c2efcf5

SHA512
c0b6be9c0d882643c1265edb0737649ce8a1702e54c25a565afa1b0bfd2864a511f5d87a45dc07c9ce91a1583b75b4cc65224474aa82b6ed112c2ef824d6d408

Download Submit
memory/112-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/112-8-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1036-5-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1036-10-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1036-12-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1036-15-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download