991d7ba765e311841da0e9a71b370c82a9be1c2ead932a1f100fc203939a43ea

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cf936003f261c5069915ee03c046b8b_JaffaCakes118.exe
Size

631KB
MD5

4cf936003f261c5069915ee03c046b8b
SHA1

309843c79de23e41d3128b65b2054f8109d59f43
SHA256

991d7ba765e311841da0e9a71b370c82a9be1c2ead932a1f100fc203939a43ea
SHA512

3ace1bd335219894cfd5c610c17debc5fba57d66a1098032eea43253f37c6317db1a796f08efef7133c649361608e7c8fec5db036fb8d91aca3d682970a8d192
SSDEEP

12288:2Xgk8wfjCDBOYKNbuUYx5b8rYF3Z4mxxdDqVTVOCYR:2XzdfwBVKNbuUAbkYQmXcVTzM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3288	cmd

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\system32\cmd	4cf936003f261c5069915ee03c046b8b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\system32\cmd	4cf936003f261c5069915ee03c046b8b_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cmd
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cmd
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cmd
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cmd

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	4cf936003f261c5069915ee03c046b8b_JaffaCakes118.exe
Token: SeDebugPrivilege	3288	cmd

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3288	cmd

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 184	3288	cmd	87
PID 3288 wrote to memory of 184	3288	cmd	87
PID 3288 wrote to memory of 184	3288	cmd	87

C:\Users\Admin\AppData\Local\Temp\4cf936003f261c5069915ee03c046b8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cf936003f261c5069915ee03c046b8b_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Program Files (x86)\system32\cmd
"C:\Program Files (x86)\system32\cmd"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3288
- C:\windows\SysWOW64\cmd.exe
  C:\windows\system32\cmd.exe
  2⤵
  PID:184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\system32\cmd

Filesize
631KB

MD5
4cf936003f261c5069915ee03c046b8b

SHA1
309843c79de23e41d3128b65b2054f8109d59f43

SHA256
991d7ba765e311841da0e9a71b370c82a9be1c2ead932a1f100fc203939a43ea

SHA512
3ace1bd335219894cfd5c610c17debc5fba57d66a1098032eea43253f37c6317db1a796f08efef7133c649361608e7c8fec5db036fb8d91aca3d682970a8d192

Download Submit
memory/2200-5-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2200-3-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2200-17-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2200-18-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/2200-13-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2200-12-0x00000000034C0000-0x00000000034C3000-memory.dmp

Filesize
12KB

Download
memory/2200-11-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/2200-10-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2200-9-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2200-8-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2200-7-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2200-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2200-4-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2200-6-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2200-19-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/2200-20-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2200-16-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2200-21-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2200-1-0x0000000002340000-0x0000000002394000-memory.dmp

Filesize
336KB

Download
memory/2200-31-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2200-32-0x0000000002340000-0x0000000002394000-memory.dmp

Filesize
336KB

Download
memory/3288-29-0x0000000000D80000-0x0000000000DD4000-memory.dmp

Filesize
336KB

Download
memory/3288-26-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/3288-33-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/3288-38-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download