0d2e62e016f98d3213e3ac755d335795035b76f6ad9d6b5370df9ca0cced055c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 09:38

Target
891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
Size 381KB
Sample240402-lmgexach9v
SHA256 0d2e62e016f98d3213e3ac755d335795035b76f6ad9d6b5370df9ca0cced055c
MD5 891820fd2e1bbe5f5f74cd2b77a1f6b9
SHA1 682a00cb848ded94d88e218f222803214a040774
SHA512 545fe42e8191657d7e45db77f58c1e83d9c8839ce07da1c1dcecb8d08056a4ca61ed2ab70e5498e15fb30e95df6b73703bd181a3d0f25040e1004f46a0c8a03c
SSDEEP 6144:wRHGKZMkhBE45nstM7gSD3OqpNsvSUvyvdLkld9Bgxoa4zrfVqAhRLh42ZdzMovS:a2SBHnsWMS3Ns5vyVcdmo9TjpKsQ7Y4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 232	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	98
PID 3668 wrote to memory of 232	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	98
PID 3668 wrote to memory of 232	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	98
PID 3668 wrote to memory of 4540	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	99
PID 3668 wrote to memory of 4540	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	99
PID 3668 wrote to memory of 4540	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	99
PID 3668 wrote to memory of 4496	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	100
PID 3668 wrote to memory of 4496	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	100
PID 3668 wrote to memory of 4496	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	100
PID 3668 wrote to memory of 4548	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	101
PID 3668 wrote to memory of 4548	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	101
PID 3668 wrote to memory of 4548	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	101
PID 3668 wrote to memory of 3984	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	102
PID 3668 wrote to memory of 3984	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	102
PID 3668 wrote to memory of 3984	3668	891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe	102

C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe"
  2⤵
  PID:232
- C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe"
  2⤵
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe"
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe"
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\891820fd2e1bbe5f5f74cd2b77a1f6b9_JaffaCakes118.exe"
  2⤵
  PID:3984

memory/3668-0-0x0000000074AD0000-0x0000000075081000-memory.dmp

Download

memory/3668-1-0x0000000000F10000-0x0000000000F20000-memory.dmp

Download

memory/3668-2-0x0000000074AD0000-0x0000000075081000-memory.dmp

Download

memory/3668-3-0x0000000074AD0000-0x0000000075081000-memory.dmp

Download

memory/3668-4-0x0000000000F10000-0x0000000000F20000-memory.dmp

Download

memory/3668-6-0x0000000074AD0000-0x0000000075081000-memory.dmp

Download