e2e5d2cb61ec3f3f01e17ac8dff23a4e1cbfd9059e9b58646e68a757a1cc976d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
Size

871KB
MD5

47f73b541c0bb1950fba158136881eec
SHA1

d395e1f33c689c35107fc2dc2c3e82f048ba2a37
SHA256

e2e5d2cb61ec3f3f01e17ac8dff23a4e1cbfd9059e9b58646e68a757a1cc976d
SHA512

301d002428d63d76c74f252a2fd1183de69a7f7cece1448be667fca02831338f64a0cfa7f9211334c2ea8389fe7d16274a3e301fe9bc23bb89ea7aa360e953ea
SSDEEP

12288:F0V3xaSQYl6UGiQ5s3XcVd03NCqV5o/JYL:F0NxaYtGims3MVadCqV54J

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2648	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	31
PID 1724 wrote to memory of 2648	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	31
PID 1724 wrote to memory of 2648	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	31
PID 1724 wrote to memory of 2648	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	31
PID 1724 wrote to memory of 2988	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2988	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2988	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2988	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2700	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	33
PID 1724 wrote to memory of 2700	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	33
PID 1724 wrote to memory of 2700	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	33
PID 1724 wrote to memory of 2700	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	33
PID 1724 wrote to memory of 2896	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	34
PID 1724 wrote to memory of 2896	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	34
PID 1724 wrote to memory of 2896	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	34
PID 1724 wrote to memory of 2896	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	34
PID 1724 wrote to memory of 2640	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	35
PID 1724 wrote to memory of 2640	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	35
PID 1724 wrote to memory of 2640	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	35
PID 1724 wrote to memory of 2640	1724	47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe"
  2⤵
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe"
  2⤵
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe"
  2⤵
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe"
  2⤵
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\47f73b541c0bb1950fba158136881eec_JaffaCakes118.exe"
  2⤵
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x00000000003C0000-0x00000000004A0000-memory.dmp

Filesize
896KB

Download
memory/1724-2-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/1724-3-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-4-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/1724-5-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-6-0x0000000004D50000-0x0000000004D9E000-memory.dmp

Filesize
312KB

Download
memory/1724-7-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download