c29d00fb65674239e992c6f9fcaa8bff51664a8cfcb50f19df5b03c20ce0cc64

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe
Size

532KB
MD5

4b64ed1f4c23e74213280b3959acd94a
SHA1

9f71c99ebcb288d168d34ed7b108fad046e44fa6
SHA256

c29d00fb65674239e992c6f9fcaa8bff51664a8cfcb50f19df5b03c20ce0cc64
SHA512

b3098696a47e1973942a546d46355a3488130398bbd34f4902b2969d13c84af2866939e374fd9c0affaba68ff055459717801aedd17076c8e8ca35af45f824b9
SSDEEP

6144:+pQH1gdUkZMpvAvzwQWw1Zm2MIgZQ2yLwVpZBERmsKF+tQ7k:+pQ2+UsfFEiF

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2116	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2932	ijowhanypo.exe

Loads dropped DLL 3 IoCs

pid	Process
2116	cmd.exe
2116	cmd.exe
2932	ijowhanypo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2164	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1800	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe
2932	ijowhanypo.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2116	2072	4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2116	2072	4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2116	2072	4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2116	2072	4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2164	2116	cmd.exe	32
PID 2116 wrote to memory of 2164	2116	cmd.exe	32
PID 2116 wrote to memory of 2164	2116	cmd.exe	32
PID 2116 wrote to memory of 2164	2116	cmd.exe	32
PID 2116 wrote to memory of 1800	2116	cmd.exe	34
PID 2116 wrote to memory of 1800	2116	cmd.exe	34
PID 2116 wrote to memory of 1800	2116	cmd.exe	34
PID 2116 wrote to memory of 1800	2116	cmd.exe	34
PID 2116 wrote to memory of 2932	2116	cmd.exe	35
PID 2116 wrote to memory of 2932	2116	cmd.exe	35
PID 2116 wrote to memory of 2932	2116	cmd.exe	35
PID 2116 wrote to memory of 2932	2116	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2072 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4b64ed1f4c23e74213280b3959acd94a_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\IJOWHA~1.EXE -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 2072
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:1800
- - C:\Users\Admin\AppData\Local\ijowhanypo.exe
    C:\Users\Admin\AppData\Local\IJOWHA~1.EXE -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\ijowhanypo.exe

Filesize
532KB

MD5
4b64ed1f4c23e74213280b3959acd94a

SHA1
9f71c99ebcb288d168d34ed7b108fad046e44fa6

SHA256
c29d00fb65674239e992c6f9fcaa8bff51664a8cfcb50f19df5b03c20ce0cc64

SHA512
b3098696a47e1973942a546d46355a3488130398bbd34f4902b2969d13c84af2866939e374fd9c0affaba68ff055459717801aedd17076c8e8ca35af45f824b9

Download Submit
memory/2072-5-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2072-4-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2072-3-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2072-2-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000220000-0x000000000026A000-memory.dmp

Filesize
296KB

Download
memory/2072-0-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2072-9-0x0000000000220000-0x000000000026A000-memory.dmp

Filesize
296KB

Download
memory/2072-8-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-17-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-18-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-16-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-15-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-20-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-21-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-22-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-23-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-24-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-25-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-26-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-27-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download
memory/2932-28-0x0000000001000000-0x00000000010C8000-memory.dmp

Filesize
800KB

Download