02c02127959dd33e5a7dc1b8cfb531a2a899c98b5827aebc2e781ebd4a769eb9

Analysis

max time kernel
141s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 16:59

Target

42909ecd1b02a8148b674cb3cda0e1d8_JaffaCakes118.exe
Size

744KB
MD5

42909ecd1b02a8148b674cb3cda0e1d8
SHA1

93acdee408c22b6fa084dd20ae5ac3e49896f00f
SHA256

02c02127959dd33e5a7dc1b8cfb531a2a899c98b5827aebc2e781ebd4a769eb9
SHA512

9cb5e0bcebbb09724f7a8bb55a518ca39be9231a11c500aa8833dcb11f3c2ae24b8a9f792799b7afaa171b921cb80227d00f137bcf5aabc5575c4d3b9d5e26d4
SSDEEP

12288:ygFAzQma3+4TTNMXOHI0isimUrASf3lAsh5zk8ttKJaSfGH1NmzhA0xvH4APbe6Y:jAzQ2BLgaV8+0TPy6ywtcek7/N

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2676	boots.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\boots.exe	42909ecd1b02a8148b674cb3cda0e1d8_JaffaCakes118.exe
File opened for modification	C:\Windows\boots.exe	42909ecd1b02a8148b674cb3cda0e1d8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	42909ecd1b02a8148b674cb3cda0e1d8_JaffaCakes118.exe
Token: SeDebugPrivilege	2676	boots.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	boots.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2080	2676	boots.exe	30
PID 2676 wrote to memory of 2080	2676	boots.exe	30
PID 2676 wrote to memory of 2080	2676	boots.exe	30
PID 2676 wrote to memory of 2080	2676	boots.exe	30

C:\Windows\boots.exe
C:\Windows\boots.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2080

C:\Windows\boots.exe

Filesize
744KB

MD5
42909ecd1b02a8148b674cb3cda0e1d8

SHA1
93acdee408c22b6fa084dd20ae5ac3e49896f00f

SHA256
02c02127959dd33e5a7dc1b8cfb531a2a899c98b5827aebc2e781ebd4a769eb9

SHA512
9cb5e0bcebbb09724f7a8bb55a518ca39be9231a11c500aa8833dcb11f3c2ae24b8a9f792799b7afaa171b921cb80227d00f137bcf5aabc5575c4d3b9d5e26d4

Download Submit
memory/2528-0-0x0000000000400000-0x00000000004C3006-memory.dmp

Filesize
780KB

Download
memory/2528-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2528-8-0x0000000000400000-0x00000000004C3006-memory.dmp

Filesize
780KB

Download
memory/2676-5-0x0000000000400000-0x00000000004C3006-memory.dmp

Filesize
780KB

Download
memory/2676-9-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2676-10-0x0000000000400000-0x00000000004C3006-memory.dmp

Filesize
780KB

Download
memory/2676-12-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download