d9863c6aa6d4c99979730d61ef2a7be3fb03519f33a6fb9edf2a54f708199683

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe
Size

325KB
MD5

4e18d1ada31c7499585b52c0d6cf82ba
SHA1

89f206434ad5137547e624f711609a1a0572943f
SHA256

d9863c6aa6d4c99979730d61ef2a7be3fb03519f33a6fb9edf2a54f708199683
SHA512

583a4ce4fdc60efaf192981509bf0a05ea15b8487336cd7e3002ad4b46deae1410e194de5559f331b5eb2e45ed22e95436e63fb04996f9e715ee814f21fa4254
SSDEEP

6144:pA1F2idZecnl20lHRxp3gKXCKEyRIhs/LpIX1nT:pUF3Z4mxxtXNRVI5T

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4656	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	892	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4188	892	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe	86
PID 892 wrote to memory of 4188	892	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe	86
PID 892 wrote to memory of 4188	892	4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4E18D1~1.EXE > nul
  2⤵
  PID:4188

C:\Windows\SysWOW64\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe
C:\Windows\SysWOW64\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe
1⤵
- Executes dropped EXE
PID:4656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\4e18d1ada31c7499585b52c0d6cf82ba_JaffaCakes118.exe

Filesize
325KB

MD5
4e18d1ada31c7499585b52c0d6cf82ba

SHA1
89f206434ad5137547e624f711609a1a0572943f

SHA256
d9863c6aa6d4c99979730d61ef2a7be3fb03519f33a6fb9edf2a54f708199683

SHA512
583a4ce4fdc60efaf192981509bf0a05ea15b8487336cd7e3002ad4b46deae1410e194de5559f331b5eb2e45ed22e95436e63fb04996f9e715ee814f21fa4254

Download Submit
memory/892-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/892-1-0x0000000000970000-0x00000000009C4000-memory.dmp

Filesize
336KB

Download
memory/892-6-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/892-28-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-71-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/892-70-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-69-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-68-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-67-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-66-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-65-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-64-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-63-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-62-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-61-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-60-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-59-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-58-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-57-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-56-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-55-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-54-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-53-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-52-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-51-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-50-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-49-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-48-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-47-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-46-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-45-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-44-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-43-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-42-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-41-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-40-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-39-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-38-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-37-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-36-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-35-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-34-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-33-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-32-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-31-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-30-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-29-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-27-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-26-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-25-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-24-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-23-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-22-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-21-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-20-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-19-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/892-18-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-17-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-16-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-15-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-14-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-13-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-12-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-11-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/892-10-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/892-9-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/892-7-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/892-8-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/892-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/892-4-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/892-3-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/892-2-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/892-75-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/892-76-0x0000000000970000-0x00000000009C4000-memory.dmp

Filesize
336KB

Download
memory/4656-77-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads