301ae9d4729d554d82391bd64b3a8145661c3b9efb30e011174a61537f294296

Analysis

max time kernel
143s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

340f49e03211b713ef239658617b8433_JaffaCakes118.exe
Size

650KB
MD5

340f49e03211b713ef239658617b8433
SHA1

a35c76897db351c3864e10927f470953fc4d7dfe
SHA256

301ae9d4729d554d82391bd64b3a8145661c3b9efb30e011174a61537f294296
SHA512

1ef24836b00dd11b8a66f4e8b6a12f1be29c84f9f22c7c6ade889b9b0d55141823a0ea1ed4ba4074245769e66bcab5f7574db7261a0e8aa1b8e2fcf8251420e4
SSDEEP

12288:TAGqfcq2o3xIsQ7bAcVrnuOwE6fki/6pJAg26yDVO5+7LtKM9lf4u92:TAGUcq13CZvAc9n1o/6pJAkA8+vtd9la

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3092	system32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32.exe	340f49e03211b713ef239658617b8433_JaffaCakes118.exe
File opened for modification	C:\Windows\system32.exe	340f49e03211b713ef239658617b8433_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	340f49e03211b713ef239658617b8433_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	340f49e03211b713ef239658617b8433_JaffaCakes118.exe
Token: SeDebugPrivilege	3092	system32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3092	system32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4296	2516	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	85
PID 2516 wrote to memory of 4296	2516	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	85
PID 2516 wrote to memory of 4296	2516	340f49e03211b713ef239658617b8433_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\340f49e03211b713ef239658617b8433_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\340f49e03211b713ef239658617b8433_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4296

C:\Windows\system32.exe
C:\Windows\system32.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32.exe

Filesize
650KB

MD5
340f49e03211b713ef239658617b8433

SHA1
a35c76897db351c3864e10927f470953fc4d7dfe

SHA256
301ae9d4729d554d82391bd64b3a8145661c3b9efb30e011174a61537f294296

SHA512
1ef24836b00dd11b8a66f4e8b6a12f1be29c84f9f22c7c6ade889b9b0d55141823a0ea1ed4ba4074245769e66bcab5f7574db7261a0e8aa1b8e2fcf8251420e4

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
aee465aaa824175f50993d6293804e59

SHA1
0f053cd520993b44fc4f8d11f0dea24cc0a4e489

SHA256
7869cc8ba6b251714e21f8819ef4fa2d4dcf053f3594ad9ea273122f24dd9f8c

SHA512
577d618dc73ab640b343c5e065a7c18b1b19e43978f99cd52bed3605132815ccec51100b2e78f6001ee0a79a14e1c32f476fe208cbce2cdaf48e15ca0f2abe66

Download Submit
memory/2516-13-0x0000000003610000-0x0000000003710000-memory.dmp

Filesize
1024KB

Download
memory/2516-27-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2516-11-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/2516-12-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2516-6-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2516-21-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/2516-20-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/2516-19-0x0000000003650000-0x0000000003651000-memory.dmp

Filesize
4KB

Download
memory/2516-18-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/2516-17-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/2516-14-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/2516-15-0x0000000003610000-0x0000000003613000-memory.dmp

Filesize
12KB

Download
memory/2516-3-0x0000000000C90000-0x0000000000CE4000-memory.dmp

Filesize
336KB

Download
memory/2516-0-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/2516-16-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/2516-5-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/2516-10-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2516-9-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2516-22-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/2516-8-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2516-4-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/2516-2-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/2516-1-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/2516-7-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2516-31-0x0000000000C90000-0x0000000000CE4000-memory.dmp

Filesize
336KB

Download
memory/3092-28-0x0000000001020000-0x0000000001074000-memory.dmp

Filesize
336KB

Download
memory/3092-33-0x0000000000400000-0x0000000000668000-memory.dmp

Filesize
2.4MB

Download
memory/3092-35-0x0000000001020000-0x0000000001074000-memory.dmp

Filesize
336KB

Download