4b1fa884e774e6a7b6d0c877d89d4cb3fa2f695f7c41016e73ac0fbf4907a846

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:46

Target

4abe88245f20dd14d33674b27ff5b8dd_JaffaCakes118.exe
Size

714KB
MD5

4abe88245f20dd14d33674b27ff5b8dd
SHA1

d528cfdae3be2a5e7d09824af78f64374d89618d
SHA256

4b1fa884e774e6a7b6d0c877d89d4cb3fa2f695f7c41016e73ac0fbf4907a846
SHA512

baa455f630373c063630f23b484446234c72d83c3cb4e53cfb23d19483dfd528dcab471a649a11818a58bdd61d16c7d682744ca8b72c5dcc9ca5657817d89afe
SSDEEP

12288:onZ+RHiZhaU//GvxsIsQhD/duTATkeJKWoLZvDBFQ7x6hwiP9FdVaJAGJH9nWP2I:BRHiZh9//GvxrsQhD/0TAIeRoLZvDzuM

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1276	www.hmhk.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\www.hmhk.cn.exe	4abe88245f20dd14d33674b27ff5b8dd_JaffaCakes118.exe
File opened for modification	C:\Windows\www.hmhk.cn.exe	4abe88245f20dd14d33674b27ff5b8dd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	4abe88245f20dd14d33674b27ff5b8dd_JaffaCakes118.exe
Token: SeDebugPrivilege	1276	www.hmhk.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	www.hmhk.cn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2420	1276	www.hmhk.cn.exe	31
PID 1276 wrote to memory of 2420	1276	www.hmhk.cn.exe	31
PID 1276 wrote to memory of 2420	1276	www.hmhk.cn.exe	31
PID 1276 wrote to memory of 2420	1276	www.hmhk.cn.exe	31

C:\Windows\www.hmhk.cn.exe
C:\Windows\www.hmhk.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2420

C:\Windows\www.hmhk.cn.exe

Filesize
714KB

MD5
4abe88245f20dd14d33674b27ff5b8dd

SHA1
d528cfdae3be2a5e7d09824af78f64374d89618d

SHA256
4b1fa884e774e6a7b6d0c877d89d4cb3fa2f695f7c41016e73ac0fbf4907a846

SHA512
baa455f630373c063630f23b484446234c72d83c3cb4e53cfb23d19483dfd528dcab471a649a11818a58bdd61d16c7d682744ca8b72c5dcc9ca5657817d89afe

Download Submit
memory/1276-6-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1276-7-0x0000000000400000-0x00000000004C7016-memory.dmp

Filesize
796KB

Download
memory/1276-8-0x0000000000400000-0x00000000004C7016-memory.dmp

Filesize
796KB

Download
memory/1276-9-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1276-13-0x0000000000400000-0x00000000004C7016-memory.dmp

Filesize
796KB

Download
memory/2404-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2404-5-0x0000000000400000-0x00000000004C7016-memory.dmp

Filesize
796KB

Download