488ae0b3a0df1a77dad45e68a114dc9b7a91bcf456709d5a4f9f2042dd8b8111

Analysis

max time kernel
137s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
Size

475KB
MD5

0102ca29c1ccb0900ac62bd3829a02c7
SHA1

1d4aa1b3dba90d0fe044ddb67a8ee535f965b698
SHA256

488ae0b3a0df1a77dad45e68a114dc9b7a91bcf456709d5a4f9f2042dd8b8111
SHA512

989388b9375d3e5568266fd01f4549a971d0960eb666a460a147f62cce530b65a4c8167bc7fcf36739c7fb13f43ada89e41845d96297ff20d27c5db456ed6904
SSDEEP

6144:aTBNAaBmTA7kra/EpqAWO55Fp1EkGcCTAOHwevOKo43HTvsAvkS/IZH:anJsTvrac8ONbGcEk4YlS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
Token: SeDebugPrivilege	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3484	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	56
PID 1344 wrote to memory of 608	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	5
PID 1344 wrote to memory of 676	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	7
PID 1344 wrote to memory of 772	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	8
PID 1344 wrote to memory of 780	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	9
PID 1344 wrote to memory of 788	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	10
PID 1344 wrote to memory of 900	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	11
PID 1344 wrote to memory of 952	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	12
PID 1344 wrote to memory of 376	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	13
PID 1344 wrote to memory of 436	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	14
PID 1344 wrote to memory of 512	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	15
PID 1344 wrote to memory of 1028	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	16
PID 1344 wrote to memory of 1092	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	17
PID 1344 wrote to memory of 1128	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	18
PID 1344 wrote to memory of 1160	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	19
PID 1344 wrote to memory of 1176	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	20
PID 1344 wrote to memory of 1292	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	21
PID 1344 wrote to memory of 1364	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	22
PID 1344 wrote to memory of 1384	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	23
PID 1344 wrote to memory of 1396	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	24
PID 1344 wrote to memory of 1408	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	25
PID 1344 wrote to memory of 1480	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	26
PID 1344 wrote to memory of 1548	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	27
PID 1344 wrote to memory of 1604	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	28
PID 1344 wrote to memory of 1660	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	29
PID 1344 wrote to memory of 1700	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	30
PID 1344 wrote to memory of 1784	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	31
PID 1344 wrote to memory of 1812	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	32
PID 1344 wrote to memory of 1832	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	33
PID 1344 wrote to memory of 1840	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	34
PID 1344 wrote to memory of 1916	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	35
PID 1344 wrote to memory of 1956	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	36
PID 1344 wrote to memory of 1220	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	37
PID 1344 wrote to memory of 60	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	38
PID 1344 wrote to memory of 2072	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	39
PID 1344 wrote to memory of 2236	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	40
PID 1344 wrote to memory of 2300	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	41
PID 1344 wrote to memory of 2308	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	42
PID 1344 wrote to memory of 2364	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	43
PID 1344 wrote to memory of 2416	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	44
PID 1344 wrote to memory of 2528	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	45
PID 1344 wrote to memory of 2540	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	46
PID 1344 wrote to memory of 2564	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	47
PID 1344 wrote to memory of 2580	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	48
PID 1344 wrote to memory of 2952	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	50
PID 1344 wrote to memory of 2980	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	51
PID 1344 wrote to memory of 3012	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	52
PID 1344 wrote to memory of 2688	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	53
PID 1344 wrote to memory of 3108	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	54
PID 1344 wrote to memory of 3396	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	55
PID 1344 wrote to memory of 3484	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	56
PID 1344 wrote to memory of 3600	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	57
PID 1344 wrote to memory of 3792	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	58
PID 1344 wrote to memory of 3884	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	59
PID 1344 wrote to memory of 3956	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	60
PID 1344 wrote to memory of 4044	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	61
PID 1344 wrote to memory of 2144	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	62
PID 1344 wrote to memory of 3684	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	65
PID 1344 wrote to memory of 4740	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	66
PID 1344 wrote to memory of 3464	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	68
PID 1344 wrote to memory of 1640	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	69
PID 1344 wrote to memory of 1760	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	70
PID 1344 wrote to memory of 1204	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	71
PID 1344 wrote to memory of 4316	1344	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	72

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:376

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2980
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3792
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3884
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3956
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4044
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2144
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1204
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3004
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3652
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:5024
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:1908
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1176
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2688
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1548
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1956

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:60

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2528

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3396

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1640

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-11-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1344-1-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1344-0-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/3484-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download