cd58b7466e29552f44ac414b97f0c162f73788f213e4dee9f759fac36e5d35f8

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 02:44

Target

f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe
Size

22KB
MD5

f28109ced0985f33f19295314c3a245a
SHA1

47613fdfd9b6eb74308ecf8ff3e9708fbbe64bed
SHA256

cd58b7466e29552f44ac414b97f0c162f73788f213e4dee9f759fac36e5d35f8
SHA512

52428a2693749adbb5611668a76f3ab639990398f56a29033c059a24b34d42599d6ff62626618a1d31239761d687d3fab2c54fd936a032079c3a97b220b5cc41
SSDEEP

384:Iq0+g2SRK6DeQ80HNb5zNcBNn1pBQTeZeEQ8UVMF1hqXiLaQCZ2lg:D1WHNbRNun3BQThCf/8iWQG2l

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_aa.bat	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4332	5076	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	98
PID 5076 wrote to memory of 4332	5076	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	98
PID 5076 wrote to memory of 4332	5076	f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f28109ced0985f33f19295314c3a245a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_aa.bat
  2⤵
  PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:2204

C:\Windows\SysWOW64\_aa.bat

Filesize
224B

MD5
9e1285601272f1d2ab832b9050039243

SHA1
979364d06926105c92e7bd9c5ef93907f631b964

SHA256
d19ebd82dd537b793ac88af89bf06b8e5e7ef8785532163acf9c38f52202a37b

SHA512
fceafa75be71bdc3bc59d9fa9ed716382713bbb40787356eebcfbc7a5cda13fb57e8d7c38af5a11c22d1c4ffade8657ccd4fcdc9f187807b5cd8623b87836fea

Download Submit
memory/5076-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5076-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5076-4-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download