c93dd9e857c708d7518dc27294da60fc86f8f3c1892356c8a9d22e00dc6cdb49

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e76a6420e57a23e42d3c846200dde60_JaffaCakes118.exe
Size

649KB
MD5

5e76a6420e57a23e42d3c846200dde60
SHA1

c833ea5325009d85c334a77a50188c3cc7df117d
SHA256

c93dd9e857c708d7518dc27294da60fc86f8f3c1892356c8a9d22e00dc6cdb49
SHA512

00fdcd61657b2a9e830e393377dff63872ef62c87dd54adb51cd9fe7c27712b8b338b787ec4c3ce66461e34787bde943fb9cddcd874555370c2b31c6c95bc3db
SSDEEP

12288:2kMUFBlnajyYT5EOGnp9y56DfirVq8MavyTTzDF3Z4mxxwxtRnoI97dbGko:FMyVYNEJQwuVPSTzDQmXmtGI97d6ko

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2316	Hacker.com.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	5e76a6420e57a23e42d3c846200dde60_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	5e76a6420e57a23e42d3c846200dde60_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	5e76a6420e57a23e42d3c846200dde60_JaffaCakes118.exe
Token: SeDebugPrivilege	2316	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2824	2316	Hacker.com.cn.exe	31
PID 2316 wrote to memory of 2824	2316	Hacker.com.cn.exe	31
PID 2316 wrote to memory of 2824	2316	Hacker.com.cn.exe	31
PID 2316 wrote to memory of 2824	2316	Hacker.com.cn.exe	31

C:\Users\Admin\AppData\Local\Temp\5e76a6420e57a23e42d3c846200dde60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e76a6420e57a23e42d3c846200dde60_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hacker.com.cn.exe

Filesize
649KB

MD5
5e76a6420e57a23e42d3c846200dde60

SHA1
c833ea5325009d85c334a77a50188c3cc7df117d

SHA256
c93dd9e857c708d7518dc27294da60fc86f8f3c1892356c8a9d22e00dc6cdb49

SHA512
00fdcd61657b2a9e830e393377dff63872ef62c87dd54adb51cd9fe7c27712b8b338b787ec4c3ce66461e34787bde943fb9cddcd874555370c2b31c6c95bc3db

Download Submit
memory/2052-10-0x0000000003280000-0x0000000003380000-memory.dmp

Filesize
1024KB

Download
memory/2052-3-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2052-21-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/2052-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2052-19-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2052-18-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2052-17-0x0000000003280000-0x0000000003283000-memory.dmp

Filesize
12KB

Download
memory/2052-16-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2052-15-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2052-14-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2052-13-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2052-12-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2052-11-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2052-1-0x0000000000520000-0x0000000000574000-memory.dmp

Filesize
336KB

Download
memory/2052-22-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2052-9-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2052-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2052-6-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2052-5-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2052-4-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2052-8-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/2052-2-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2052-7-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2052-23-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/2052-30-0x0000000000520000-0x0000000000574000-memory.dmp

Filesize
336KB

Download
memory/2052-31-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2316-27-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2316-32-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2316-33-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2316-37-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download