c920a3a7aa1c3d0bedf54775af398d8181b1dc9f81febf722881c48b493ed252

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:20

Target

67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
Size

16KB
MD5

67be3b42006b0d68b7d0a07728c16daa
SHA1

74ad241426962ade8241ba05120b8bbc48800f4a
SHA256

c920a3a7aa1c3d0bedf54775af398d8181b1dc9f81febf722881c48b493ed252
SHA512

5d6f9c8174d5bc1609ad198c2db4db550afc48bc6a77207c8cc301f435a6c870518e6e6c1dba1e7e47f83eef0cdcab7fb3b960d36af55ef248c3c64bbbdd0456
SSDEEP

384:J0KkDJcfEcb6Qx0i6/LAi4bOBcgAxwr6+e9Pfqbn1:RsvQCi6/Lp4C2x3ha5

Score

7^/10

aspackv2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral1/files/0x000c000000012272-9.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2756	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	Compatibility.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Compatibility.exe	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Compatibility.exe	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Compatibility.exe	Compatibility.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
2680	Compatibility.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2680	Compatibility.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2680	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2756	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	31
PID 2368 wrote to memory of 2756	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	31
PID 2368 wrote to memory of 2756	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	31
PID 2368 wrote to memory of 2756	2368	67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe	31
PID 2680 wrote to memory of 2688	2680	Compatibility.exe	32
PID 2680 wrote to memory of 2688	2680	Compatibility.exe	32
PID 2680 wrote to memory of 2688	2680	Compatibility.exe	32
PID 2680 wrote to memory of 2688	2680	Compatibility.exe	32

C:\Users\Admin\AppData\Local\Temp\67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67be3b42006b0d68b7d0a07728c16daa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\Compatibility.exe
  "C:\Windows\system32\Compatibility.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\COMPAT~1.EXE > nul
    3⤵
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\67BE3B~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2756

C:\Windows\SysWOW64\Compatibility.exe

Filesize
16KB

MD5
67be3b42006b0d68b7d0a07728c16daa

SHA1
74ad241426962ade8241ba05120b8bbc48800f4a

SHA256
c920a3a7aa1c3d0bedf54775af398d8181b1dc9f81febf722881c48b493ed252

SHA512
5d6f9c8174d5bc1609ad198c2db4db550afc48bc6a77207c8cc301f435a6c870518e6e6c1dba1e7e47f83eef0cdcab7fb3b960d36af55ef248c3c64bbbdd0456

Download Submit
memory/2368-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2680-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2680-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download