9ab0454b1c89f9ab21865516283b864de57874ced4dde085413a0ad67b47d9dc

Analysis

max time kernel
120s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
Size

84KB
MD5

20a0d06563330c7dbd5afe77f7e9428e
SHA1

ebb0e2cd05461eedfe6f09a3d4c4a587d5de2bca
SHA256

9ab0454b1c89f9ab21865516283b864de57874ced4dde085413a0ad67b47d9dc
SHA512

af4dc6002d073b6b4a82081eccd12b27d5f17aea31d4c16d2565dd7e929b49152c04e1ca728f67bc2896743e94b2c6ada26c9910fe61f9b575961eec0a6cb9aa
SSDEEP

1536:LCjPJjywFDzVUMKQNxGjgukyWKw9ufa6WuGvP:L+PJ/h7K2yNwsC6q

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

3112 takeown.exe
2184 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

3112 takeown.exe
2184 icacls.exe

pid	process
3112	takeown.exe
2184	icacls.exe

pid	process
3112	takeown.exe
2184	icacls.exe

Drops file in System32 directory 4 IoCs

Processes:

20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ole.dll	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\imm32.dll.log	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\imm32.dll.log	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\imm32.dll	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

pid process

660 20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
660 20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exetakeown.exe

description pid process

Token: SeDebugPrivilege 660 20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege 3112 takeown.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

pid process

660 20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
660 20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

pid	process
660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3112	takeown.exe

pid	process
660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe

description	pid	process	target process
PID 660 wrote to memory of 3112	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	takeown.exe
PID 660 wrote to memory of 3112	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	takeown.exe
PID 660 wrote to memory of 3112	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	takeown.exe
PID 660 wrote to memory of 2184	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	icacls.exe
PID 660 wrote to memory of 2184	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	icacls.exe
PID 660 wrote to memory of 2184	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	icacls.exe
PID 660 wrote to memory of 664	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	cmd.exe
PID 660 wrote to memory of 664	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	cmd.exe
PID 660 wrote to memory of 664	660	20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20a0d06563330c7dbd5afe77f7e9428e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\SysWOW64\takeown.exe
takeown /F C:\Windows\system32\imm32.dll
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\system32\imm32.dll /grant administrators:f
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\dele575d81.bat
2⤵
PID:664

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\dele575d81.bat
Filesize
235B

MD5
7c5fd877cf5707f1a43564637f633d28

SHA1
d2216e15e0b630019014cb2e4ecd89fe101a403f

SHA256
7377e0abd61dfced7334976a97bf323d87eb210252250e7ed6c7712f6a9b4558

SHA512
4cb6d5fd97c0a3af4de22156d4ae6d8bfc39926be90406ad641043fa58855628f11fc31c72eb38064d3ee5aba284d3876e91f687477798e013da3d2242ca85f3

Download Submit
memory/660-9-0x0000000076920000-0x0000000076945000-memory.dmp

Filesize
148KB

Download