301ae9d4729d554d82391bd64b3a8145661c3b9efb30e011174a61537f294296

Analysis

max time kernel
125s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

340f49e03211b713ef239658617b8433_JaffaCakes118.exe
Size

650KB
MD5

340f49e03211b713ef239658617b8433
SHA1

a35c76897db351c3864e10927f470953fc4d7dfe
SHA256

301ae9d4729d554d82391bd64b3a8145661c3b9efb30e011174a61537f294296
SHA512

1ef24836b00dd11b8a66f4e8b6a12f1be29c84f9f22c7c6ade889b9b0d55141823a0ea1ed4ba4074245769e66bcab5f7574db7261a0e8aa1b8e2fcf8251420e4
SSDEEP

12288:TAGqfcq2o3xIsQ7bAcVrnuOwE6fki/6pJAg26yDVO5+7LtKM9lf4u92:TAGUcq13CZvAc9n1o/6pJAkA8+vtd9la

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	system32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	340f49e03211b713ef239658617b8433_JaffaCakes118.exe
File created	C:\Windows\system32.exe	340f49e03211b713ef239658617b8433_JaffaCakes118.exe
File opened for modification	C:\Windows\system32.exe	340f49e03211b713ef239658617b8433_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe
Token: SeDebugPrivilege	2860	system32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	system32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31
PID 2736 wrote to memory of 2760	2736	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\340f49e03211b713ef239658617b8433_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\340f49e03211b713ef239658617b8433_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2760

C:\Windows\system32.exe
C:\Windows\system32.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32.exe

Filesize
650KB

MD5
340f49e03211b713ef239658617b8433

SHA1
a35c76897db351c3864e10927f470953fc4d7dfe

SHA256
301ae9d4729d554d82391bd64b3a8145661c3b9efb30e011174a61537f294296

SHA512
1ef24836b00dd11b8a66f4e8b6a12f1be29c84f9f22c7c6ade889b9b0d55141823a0ea1ed4ba4074245769e66bcab5f7574db7261a0e8aa1b8e2fcf8251420e4

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
aee465aaa824175f50993d6293804e59

SHA1
0f053cd520993b44fc4f8d11f0dea24cc0a4e489

SHA256
7869cc8ba6b251714e21f8819ef4fa2d4dcf053f3594ad9ea273122f24dd9f8c

SHA512
577d618dc73ab640b343c5e065a7c18b1b19e43978f99cd52bed3605132815ccec51100b2e78f6001ee0a79a14e1c32f476fe208cbce2cdaf48e15ca0f2abe66

Download Submit
memory/2736-33-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/2736-22-0x00000000033D0000-0x00000000033D3000-memory.dmp

Filesize
12KB

Download
memory/2736-27-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/2736-31-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2736-25-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/2736-29-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2736-23-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/2736-30-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2736-21-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-20-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-19-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-18-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-17-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-16-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-15-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-14-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-13-0x00000000033D0000-0x00000000034D0000-memory.dmp

Filesize
1024KB

Download
memory/2736-12-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2736-32-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/2736-26-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/2736-3-0x00000000003A0000-0x00000000003F4000-memory.dmp

Filesize
336KB

Download
memory/2736-24-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/2736-28-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2736-11-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/2736-10-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/2736-9-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/2736-8-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/2736-7-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2736-6-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/2736-5-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/2736-4-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2736-34-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/2736-2-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2736-48-0x00000000003A0000-0x00000000003F4000-memory.dmp

Filesize
336KB

Download
memory/2736-39-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2736-0-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2860-40-0x0000000000940000-0x0000000000994000-memory.dmp

Filesize
336KB

Download
memory/2860-38-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2860-50-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2860-51-0x0000000000940000-0x0000000000994000-memory.dmp

Filesize
336KB

Download