d131111b8dd626cf9d217fa4daff441fdfb4c71308841bf339659ab7eb803705

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:25

Target

2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe
Size

178KB
MD5

2d54673be03f5ac0529ff7d08a3a814f
SHA1

976938d9bde06c0d7d23fa89be741d5b5d4c77d1
SHA256

d131111b8dd626cf9d217fa4daff441fdfb4c71308841bf339659ab7eb803705
SHA512

a62dceb92cf6ff25cfc495f4c94f9dbb754cc6bc60033bde32f39378526a5428d9955b6ebcd30283fa3e536560d6add0a244a59d232bf487f5096393e5110f0d
SSDEEP

1536:owz/ODxXYbN1Oz6B+uoIgs3Z/ObVtBZwMlTJ3ScZ45gQYK/TAJPT4Up4ewWrZ+yL:Vrtou45zbHbwaTJCcZ+2gTA51NJgyL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2644	2176	2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2644	2176	2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2644	2176	2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d54673be03f5ac0529ff7d08a3a814f_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Java\jre7\bin\java.exe
  "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\labymod-wininstaller/LabyMod3_Installer.jar
  2⤵
  PID:2644

C:\Users\Admin\AppData\Local\Temp\labymod-wininstaller\LabyMod3_Installer.jar

Filesize
1.2MB

MD5
746a78b327ca140e1f36e068fb7c711f

SHA1
8475acb133ec165f2b81b3664b4fb48ebbe1aa6b

SHA256
32fa0240eff609ed0ca082e0f4bc167527cbc928df0dc5dc02e679f9ef3ab4df

SHA512
cc09f42262499ddfad172d1e9e3a978aed5a6dad3f75be0ea6a615eb0ff1b94857970a83078bc820b81e80b036f509496516dab524a30214bb088564dfd8e266

Download Submit
memory/2176-0-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000000860000-0x0000000000884000-memory.dmp

Filesize
144KB

Download
memory/2176-2-0x0000000000140000-0x000000000018E000-memory.dmp

Filesize
312KB

Download
memory/2176-3-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2176-4-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2176-7-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-10-0x0000000002540000-0x00000000027B0000-memory.dmp

Filesize
2.4MB

Download
memory/2644-19-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2644-20-0x0000000002540000-0x00000000027B0000-memory.dmp

Filesize
2.4MB

Download