ca7c1c43954d51186a10216ecfbb03dd4c510da511c40e421954475faa8bd8fe

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 00:05

Target

4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
Size

60KB
MD5

4bfd2afab47f7c8c83ad7aab5fd47438
SHA1

cae403a3d46db081d9516e74217e1712d62329d3
SHA256

ca7c1c43954d51186a10216ecfbb03dd4c510da511c40e421954475faa8bd8fe
SHA512

30290e7b148efdaf0e4cb535d969394115f86e40451d11a228484bb08df53a36e34b872eb7f596f6db3c30e897abb8f727646e21e4cac3f3fc71b09430705495
SSDEEP

1536:ai3ri/WVJ8Foz1a0T2YMFH88O92vS+PvhMgHv:a5ilNbcS+Pb

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/836-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/836-17-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jvijwer.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sucken1.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sucken2.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sucken3.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sucken4.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sucken1.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sucken2.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sucken3.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sucken4.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sucken5.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sucken5.dat	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\jviwer\smouhbgmj.dll	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
476	Process not Found
836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
476	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2524	836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe	30
PID 836 wrote to memory of 2524	836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe	30
PID 836 wrote to memory of 2524	836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe	30
PID 836 wrote to memory of 2524	836	4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4bfd2afab47f7c8c83ad7aab5fd47438_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4BFD2A~1.EXE
  2⤵
  - Deletes itself
  PID:2524

\Program Files\jviwer\smouhbgmj.dll

Filesize
79KB

MD5
79c0a9005d41dc8d6adc6b952cd6d74e

SHA1
1dc9c833dc645544fada128597d972766b467def

SHA256
75e1f2347e9aac4a12ac4acafb5e764d63767e07762e56fc0e343b5fd020ee71

SHA512
3d22168919ade8b641aa689368e69014aef5a3ef4048342a4387ae1a37a966500b68a50808a5cafff1b0d333c0325d1182a8c8c4a0e8c38af50a149bda965887

Download Submit
memory/836-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/836-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/836-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download