e408931bf1e01ffdc061569ff4d002133a0abaf9d0ef500402bfd91965cd7b89

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:20

Target

f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe
Size

32KB
MD5

f6b26d56c14e78566ec318f338323d4c
SHA1

1d1fe464ac465e12a6a5a3a8392b96c9c689ba5c
SHA256

e408931bf1e01ffdc061569ff4d002133a0abaf9d0ef500402bfd91965cd7b89
SHA512

a033bd4fdcdce1ee7beb2ecafac505a8bc7f48c22ef2ba0ed7b02a99abedfa1015ae8572c00d3a8076d868f021924f0ba4a224e21a2cf6d449b9211a1760a9cd
SSDEEP

768:iA+eZihQ7WcdcXa2jFkbb4vS0TxRGAa3x/GmyfPIJeNVE:iA+s9zdcXa2j2eZAE3dNVE

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4520	f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4140	4520	f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe	85
PID 4520 wrote to memory of 4140	4520	f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe	85
PID 4520 wrote to memory of 4140	4520	f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6b26d56c14e78566ec318f338323d4c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\F6B26D~1.EXE > nul
  2⤵
  PID:4140

memory/4520-0-0x0000000000400000-0x000000000040F0F1-memory.dmp

Filesize
60KB

Download
memory/4520-1-0x0000000000400000-0x000000000040F0F1-memory.dmp

Filesize
60KB

Download