Overview

overview

7

Static

static

3

42b7b593b7...18.exe

windows7-x64

7

42b7b593b7...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 17:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    42b7b593b72c1ad3f442764a01c355f3_JaffaCakes118.exe

  • Size

    141KB

  • MD5

    42b7b593b72c1ad3f442764a01c355f3

  • SHA1

    1ea19dbffdda4e944f26a3e280f08982f491fb54

  • SHA256

    12b0981fcfb575c4faac13ac9c85a497cb6b022b2ddc4b79a9b90640fd1d4c5a

  • SHA512

    0210badf3dfa36d5aee44d3bdce63f355b762d967189a0c1d49fcd8d88e64cef45a6b8e4acc9868255b22bd2400786f35898570d1451105cac6874e81b82aaff

  • SSDEEP

    3072:OMDGOI4lS9I2MD9BxjtzPWtTVzCGDcaN9dGku1r:XDoT9IPxpPcVzCGDcajdnu1r

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42b7b593b72c1ad3f442764a01c355f3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\42b7b593b72c1ad3f442764a01c355f3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\pclt32.exe
      C:\Windows\system32\pclt32.exe -d "C:\Users\Admin\AppData\Local\Temp\42b7b593b72c1ad3f442764a01c355f3_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2812
  • C:\Windows\SysWOW64\pclt32.exe
    C:\Windows\SysWOW64\pclt32.exe -v
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\pclt32.exe
    Filesize

    141KB

    MD5

    7ca84e28af444f71f798571122379776

    SHA1

    f1f47a9a6d60a8caacbbcca606cd0b1540f3c935

    SHA256

    4647ab6ceae7af54063a2b3343c178176808432b2121ade93745642795bd02f1

    SHA512

    bef3e874269bd8e24a6cfc2d4aa93fac37a4cc051074d32d1425a21e9c13a7226029a2c6d978be095b5de07d00fd0cc8777ece603b6675f4bf0e6d6d8bffee62

    Download Submit