cf103b6f3ba1d46dffad961cc90117512a47d55c112b5e0dc276c4c9a5db4830

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe
Size 386KB
Sample240713-fe312swfjm
SHA256 cf103b6f3ba1d46dffad961cc90117512a47d55c112b5e0dc276c4c9a5db4830
MD5 40424cdfc5f7e34a36fc23ea2e1b52a6
SHA1 c53c6e1f8f3b695846f316c6aca1f16bc7dad414
SHA512 a288c9760ebb9b84464b03fa2f84da5efa3c3b7b24c7b0ca768d327a37b34a1a73ee5d3226ec2e332ca88597a53e54fe64e7d540009ebf7372dd7c6aab6dc167
SSDEEP 6144:5hs1zEx1UtcBCdkPDG9kZ5Mo71xiMui07UWtmGBTU/JXmu8mGc2Bbs5B:5hsm2teCqPDGCDM61Gi07UWESuXmuHoK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4624	lpi.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\lpi.exe	40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe
396	40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe
4624	lpi.exe
4624	lpi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1840	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	1840	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1840	IEXPLORE.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 5060	396	40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe	89
PID 396 wrote to memory of 5060	396	40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe	89
PID 396 wrote to memory of 5060	396	40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe	89
PID 4624 wrote to memory of 1840	4624	lpi.exe	90
PID 4624 wrote to memory of 1840	4624	lpi.exe	90
PID 4624 wrote to memory of 1840	4624	lpi.exe	90
PID 4624 wrote to memory of 1840	4624	lpi.exe	90
PID 4624 wrote to memory of 1840	4624	lpi.exe	90

C:\Users\Admin\AppData\Local\Temp\40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40424cdfc5f7e34a36fc23ea2e1b52a6_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ICDISL.bat
  2⤵
  PID:5060

C:\Program Files\Windows NT\lpi.exe
"C:\Program Files\Windows NT\lpi.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 85899
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

lpi.exe

Path C:\Program Files\Windows NT\lpi.exe
Size 386KB
SHA256 cf103b6f3ba1d46dffad961cc90117512a47d55c112b5e0dc276c4c9a5db4830
MD5 40424cdfc5f7e34a36fc23ea2e1b52a6
SHA1 c53c6e1f8f3b695846f316c6aca1f16bc7dad414
SHA512 a288c9760ebb9b84464b03fa2f84da5efa3c3b7b24c7b0ca768d327a37b34a1a73ee5d3226ec2e332ca88597a53e54fe64e7d540009ebf7372dd7c6aab6dc167
SSDEEP 6144:5hs1zEx1UtcBCdkPDG9kZ5Mo71xiMui07UWtmGBTU/JXmu8mGc2Bbs5B:5hsm2teCqPDGCDM61Gi07UWESuXmuHoK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ICDISL.bat

Path C:\Users\Admin\AppData\Local\Temp\ICDISL.bat
Size 218B
SHA256 6ae5be5d6a95354a50b67945d435cc06c9e03a9979fa0f470af68400778a5e3a
MD5 98e002575a1fa0a654584387aa74e26c
SHA1 4284b221fcec2fcc2ca57091239e88af9d89a682
SHA512 e371597b593e1d2e5dd8c9d9679c659b3705966f9950faefaf24d50b7d519ee171d49a7cf338cb99578c98c8ce0b444df0e146df2eceba38f414b1148680dfea
MD5 SHA1 SHA512

Submit Download

memory/396-6-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-24-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-0-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-9-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-8-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-7-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-2-0x0000000001021000-0x00000000010D9000-memory.dmp

Download

memory/396-1-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/396-25-0x0000000001021000-0x00000000010D9000-memory.dmp

Download

memory/396-3-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-19-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-18-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-16-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-20-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-21-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-14-0x0000000001020000-0x000000000113D928-memory.dmp

Download

memory/4624-27-0x0000000001020000-0x000000000113D928-memory.dmp

Download