7a3c595192d945997b92345c47e12f9a63814e4a8c2f297c5f963cb82a8b1010

Analysis

max time kernel
142s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 04:38

Target

662b8f96d840def4219518e6887ea485_JaffaCakes118.exe
Size

424KB
MD5

662b8f96d840def4219518e6887ea485
SHA1

675497501105e23e6e2071ca3d8c0e4d70320584
SHA256

7a3c595192d945997b92345c47e12f9a63814e4a8c2f297c5f963cb82a8b1010
SHA512

18604e017f33c0dfa85b506c35f70f57e6a3b773b812bee15ae511eb9bfd3674adb49588454a7985daa7de4cbc6d50e7cfe659f5ce6fe0aafcf0543c9cd345b4
SSDEEP

12288:Q/+ap1txjxCL9UqqvOJlUmxsnbJKwKcx4ZYJDK0i:4pjHCbqSsbJ0cmYJ+0i

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
544	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe
File created	C:\Windows\UNINSTAL.BAT	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	1212	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe
Token: SeDebugPrivilege	544	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
544	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1008	544	svchost.exe	88
PID 544 wrote to memory of 1008	544	svchost.exe	88
PID 1212 wrote to memory of 2412	1212	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe	96
PID 1212 wrote to memory of 2412	1212	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe	96
PID 1212 wrote to memory of 2412	1212	662b8f96d840def4219518e6887ea485_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\662b8f96d840def4219518e6887ea485_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\662b8f96d840def4219518e6887ea485_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 684
  2⤵
  - Program crash
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
  2⤵
  PID:2412

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1212 -ip 1212
1⤵
PID:1092

C:\Windows\UNINSTAL.BAT

Filesize
214B

MD5
7f5335680cc3ffe501228678c22e68d6

SHA1
cd6c9258650e8093c87be75af19bb64c401ad28f

SHA256
031ef4d7e92d294f9fc7e1540e01a8a28dfa6eef07bb7389a6a3f4277ccec489

SHA512
edba1b2ae5f03cd597ddb43e1c7440216f4cc26e558d4d3310af9fbede34f63c90478f9b74d1e48c298bd700de7b8614b1b78c902794b95524a4258d9bc4d6a4

Download Submit
C:\Windows\svchost.exe

Filesize
424KB

MD5
662b8f96d840def4219518e6887ea485

SHA1
675497501105e23e6e2071ca3d8c0e4d70320584

SHA256
7a3c595192d945997b92345c47e12f9a63814e4a8c2f297c5f963cb82a8b1010

SHA512
18604e017f33c0dfa85b506c35f70f57e6a3b773b812bee15ae511eb9bfd3674adb49588454a7985daa7de4cbc6d50e7cfe659f5ce6fe0aafcf0543c9cd345b4

Download Submit
memory/544-5-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/544-10-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/544-12-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/1212-0-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/1212-8-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download