75cab67ec5b65d3660087ceb2e66556701cc5afaf319c16db4908a032ccaec51

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 19:39

Target

64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe
Size

381KB
MD5

64878469668977beb0edb8d81df20ca1
SHA1

528c0df03fa1356b06a4985f4b5747f952e93f99
SHA256

75cab67ec5b65d3660087ceb2e66556701cc5afaf319c16db4908a032ccaec51
SHA512

d1bfd0ea7b91551de31b68f3472b9e94f6d26be8fb0aae09496c12b05cf246052efe52e377aacd1df542bfa63d77be598bf477042790c00e2bb588b6a9d47224
SSDEEP

6144:GYympWchgXVwcqU2t3en4jflXrBmeUGa+6AzwBsKs7+M86a5uebO:G9mKODZecflXroehaRCwKKdMfaW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2736	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2424	smss.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\pRogram Files\smss.exe	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe
File opened for modification	C:\pRogram Files\smss.exe	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.BAT	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe
Token: SeDebugPrivilege	2424	smss.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	smss.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2736	3012	64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64878469668977beb0edb8d81df20ca1_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.BAT
  2⤵
  - Deletes itself
  PID:2736

C:\Program Files\smss.exe

Filesize
381KB

MD5
64878469668977beb0edb8d81df20ca1

SHA1
528c0df03fa1356b06a4985f4b5747f952e93f99

SHA256
75cab67ec5b65d3660087ceb2e66556701cc5afaf319c16db4908a032ccaec51

SHA512
d1bfd0ea7b91551de31b68f3472b9e94f6d26be8fb0aae09496c12b05cf246052efe52e377aacd1df542bfa63d77be598bf477042790c00e2bb588b6a9d47224

Download Submit
C:\Windows\uninstal.BAT

Filesize
218B

MD5
e4bd35c0fc5958158f3e1bb1aad20942

SHA1
8b8d3e139db6564b89d01e4965d3711f409efd3e

SHA256
3e2c67aaade6d2a82175c96ec67908a053e4b7c142d87f6f72b7ef756cbc3a43

SHA512
f7b29cd24368b973ef543f886e1875315900a2b299201003bef041bb90c8a1291ed28b5b3e6012b4f1e4051ff44be00aa9d8b8b9d51f9212a4b70a8445e861f5

Download Submit
memory/2424-8-0x0000000000400000-0x0000000000522208-memory.dmp

Filesize
1.1MB

Download
memory/2424-9-0x0000000000400000-0x0000000000522208-memory.dmp

Filesize
1.1MB

Download
memory/2424-19-0x0000000000400000-0x0000000000522208-memory.dmp

Filesize
1.1MB

Download
memory/3012-1-0x0000000000400000-0x0000000000522208-memory.dmp

Filesize
1.1MB

Download
memory/3012-2-0x00000000004C2000-0x0000000000521000-memory.dmp

Filesize
380KB

Download
memory/3012-5-0x0000000000400000-0x0000000000522208-memory.dmp

Filesize
1.1MB

Download
memory/3012-17-0x00000000004C2000-0x0000000000521000-memory.dmp

Filesize
380KB

Download