22ef5ba8f175935fe47f3c56fcb978e2294447aca632bef21b5a6eeb473494e4

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:22

Target

281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe
Size

615KB
MD5

281121def24b74d05163c8dbe856ea81
SHA1

fd898cc9900fa13477c5af1a862ba4a25f97075b
SHA256

22ef5ba8f175935fe47f3c56fcb978e2294447aca632bef21b5a6eeb473494e4
SHA512

84a5c8bc0bb4bd2d47a81dbd788f14314996191b060c65c86ff5d85292fd031085b8d8f37300170aa6cc597f81eefd7c9eee77e45fde738c073b6bb35aa23622
SSDEEP

12288:X90RlszFRkBWmvgtL3cRKaQfSIC9wf+laHH6dNTBMo:X93CotLSKaQ6L9wNHad

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 880	2592	281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe	88
PID 2592 wrote to memory of 880	2592	281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe	88
PID 2592 wrote to memory of 880	2592	281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe	88
PID 2592 wrote to memory of 4316	2592	281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe	89
PID 2592 wrote to memory of 4316	2592	281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe	89
PID 2592 wrote to memory of 4316	2592	281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:880
- C:\Users\Admin\AppData\Local\Temp\281121def24b74d05163c8dbe856ea81_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
1⤵
PID:1076

memory/880-5-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/880-8-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/880-4-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/880-10-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2592-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2592-1-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2592-2-0x000000000046C000-0x000000000046E000-memory.dmp

Filesize
8KB

Download
memory/2592-3-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4316-7-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4316-9-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4316-11-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download