09e4d676819b28e7211ddc55a196a8b4fcce6ef0d2c6051147fd26d35c0c91c2

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
Size

74KB
MD5

3f81a863b7651638e601e1b3f1c91737
SHA1

402226850856fdb51b5f84e34041464f0c37f4b7
SHA256

09e4d676819b28e7211ddc55a196a8b4fcce6ef0d2c6051147fd26d35c0c91c2
SHA512

d003673af9f8dd6037d6d595b0b3e541aafd7a371d6a6b7eb0652a22a83067046b27c335fc0e1c5f525f739860ed6a4dbd938413c103bd250420944f35e5d108
SSDEEP

1536:+vYwDmDWCm0tT6zaLFi95Ljg2JfeD0vBzvX62:21B0thE9tjg2JmDYBzv5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3152	svhost32.exe

Loads dropped DLL 4 IoCs

pid	Process
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllwm.dll	svhost32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\svhost32.exe	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
File opened for modification	C:\Program Files\svhost32.exe	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe
3152	svhost32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3152	svhost32.exe
3152	svhost32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 436	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	87
PID 1620 wrote to memory of 436	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	87
PID 1620 wrote to memory of 1900	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	88
PID 1620 wrote to memory of 1900	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	88
PID 1620 wrote to memory of 1900	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	88
PID 1620 wrote to memory of 3152	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	89
PID 1620 wrote to memory of 3152	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	89
PID 1620 wrote to memory of 3152	1620	3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f81a863b7651638e601e1b3f1c91737_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$c9AC9.tmp.bat
  2⤵
  PID:1900
- C:\Program Files\svhost32.exe
  "C:\Program Files\svhost32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\svhost32.exe

Filesize
74KB

MD5
3f81a863b7651638e601e1b3f1c91737

SHA1
402226850856fdb51b5f84e34041464f0c37f4b7

SHA256
09e4d676819b28e7211ddc55a196a8b4fcce6ef0d2c6051147fd26d35c0c91c2

SHA512
d003673af9f8dd6037d6d595b0b3e541aafd7a371d6a6b7eb0652a22a83067046b27c335fc0e1c5f525f739860ed6a4dbd938413c103bd250420944f35e5d108

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$c9AC9.tmp.bat

Filesize
261B

MD5
c6e43d1445be003f620b9c93072ea90b

SHA1
35c9ca0200cec4643f206a9973c633a7173d8008

SHA256
f7476ea6d80ebf2c71f119aad4fa4c56aba6bdf1a2a5d62930ebdc43d2301127

SHA512
c1ca70b95843a8199a8b470a577ab36c9897b97c73aca38b6c7fcb0ced7086b1745c57f5a805c0f7f1ff2249c5fae39cb49ee90f19f3d38fdad8a4dd23876554

Download Submit
C:\Users\Admin\AppData\Local\Temp\g.dll

Filesize
23KB

MD5
40a113d612d908ca3b871a951310424a

SHA1
2d0e67a9de77c110369b4ad6e87ce71583e8bfb9

SHA256
c6bbe3988ce1fe99c8e16af6b2000e5f235067899ce5c5303e19cd9f3125edac

SHA512
2e49e2d79d7ac9e69c43bf0321a31bc4908c972d55944d61dcd12acd86274cad6268270139614d4659d1eed311de01d7b136247335cea2e65eb03e3b6c2f51ed

Download Submit
C:\Windows\SysWOW64\dllwm.dll

Filesize
32KB

MD5
cb1ea35b9f4ead1d2ff8c949b2d1caa5

SHA1
ccaa6b5df37221062599da7daffc3a41dbe1e060

SHA256
157dd076feacaf20e4115a8b38d17d125bb171cac5418598454b9dec1d4893e7

SHA512
d320f90c249893d714d2dfbf703858873e24d82a8097ab6d14488e2538f1506cbde7e117c5883a1b86b7aeb4b123697050e14c9e0fe95a38e025a61a9ff0da43

Download Submit
memory/1620-19-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1620-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1620-6-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/1620-18-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1620-9-0x0000000000430000-0x0000000000450000-memory.dmp

Filesize
128KB

Download
memory/1620-5-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3152-21-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3152-20-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3152-22-0x0000000000520000-0x0000000000540000-memory.dmp

Filesize
128KB

Download
memory/3152-23-0x0000000000500000-0x0000000000520000-memory.dmp

Filesize
128KB

Download
memory/3152-32-0x00000000005A0000-0x00000000005B8000-memory.dmp

Filesize
96KB

Download
memory/3152-31-0x00000000005A0000-0x00000000005B8000-memory.dmp

Filesize
96KB

Download
memory/3152-33-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/3152-34-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3152-35-0x0000000000520000-0x0000000000540000-memory.dmp

Filesize
128KB

Download
memory/3152-36-0x00000000005A0000-0x00000000005B8000-memory.dmp

Filesize
96KB

Download