Analysis

  • max time kernel
    142s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 06:13

General

  • Target

    3c42b9dce31f458c0b19bb8610c74a35_JaffaCakes118.exe

  • Size

    289KB

  • MD5

    3c42b9dce31f458c0b19bb8610c74a35

  • SHA1

    d97685a5a6c502f13893276744390cc4a9b0aa12

  • SHA256

    0028a4fcf54a82082e18a2ba5138ced9a03800d328c1d9e1dd69792ab45cd744

  • SHA512

    72bfe5148c611679d78b2557742ace19bc9867cdb33b58689b848421dc4b9e61d3f9aeadaeec343442d56b277c6e6721180aa06480424d9bb50015101c6194ca

  • SSDEEP

    6144:rHnR5hyrRN+QxfuKrDIdYrq53YtQoN9NPE/NeLDJOvqb/p1o:tLydRmKr0QqetXV8YJmqjjo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c42b9dce31f458c0b19bb8610c74a35_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3c42b9dce31f458c0b19bb8610c74a35_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
      2⤵
        PID:3104
    • C:\Program Files\Internet Explorer\IEXPLORER.EXE
      "C:\Program Files\Internet Explorer\IEXPLORER.EXE"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1248

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Internet Explorer\IEXPLORER.EXE

      Filesize

      289KB

      MD5

      3c42b9dce31f458c0b19bb8610c74a35

      SHA1

      d97685a5a6c502f13893276744390cc4a9b0aa12

      SHA256

      0028a4fcf54a82082e18a2ba5138ced9a03800d328c1d9e1dd69792ab45cd744

      SHA512

      72bfe5148c611679d78b2557742ace19bc9867cdb33b58689b848421dc4b9e61d3f9aeadaeec343442d56b277c6e6721180aa06480424d9bb50015101c6194ca

    • C:\Windows\uninstal.bat

      Filesize

      218B

      MD5

      0c3f6e15c6301803948dbe66ba57997c

      SHA1

      56260f4e605b5e0d4bdf8022019e4159e05493f2

      SHA256

      3e4f7e6a57fa032b82a28e34ceb60e4498a1aa974a58d391c9fc6873c73b2b5e

      SHA512

      3cdbef765fe76b77994e502a07740290b80d05a68ad9b16d6d24b591460e1e10d8807bb21a7933bd4eb2801fcab24c14dbf4a78ef5681f26c87c9caf71dfec3e

    • memory/1248-7-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/1248-8-0x00000000007D0000-0x00000000007D1000-memory.dmp

      Filesize

      4KB

    • memory/1248-13-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/1248-14-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/1248-15-0x00000000007D0000-0x00000000007D1000-memory.dmp

      Filesize

      4KB

    • memory/1248-19-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2276-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/2276-0-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2276-2-0x00000000021A0000-0x00000000021A1000-memory.dmp

      Filesize

      4KB

    • memory/2276-11-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB