102f3f47b7babe90ea9d6af0913c4036931ec86e2a7c6edd6bce415ed8286cfb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 14:02

Target

7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
Size

586KB
MD5

7d39468c9c7a5e722cdf752071865924
SHA1

9b5ba1e2fa3ddad0966fd404c0a01b6be7f2359d
SHA256

102f3f47b7babe90ea9d6af0913c4036931ec86e2a7c6edd6bce415ed8286cfb
SHA512

1e03e8703b72d6ee729895973296d1e5d333089c19efb35bc5850fe43df70bd4c82a77475d0cc0ab427ee1ef5e471148e62296392eead508f14b49df93c2a7ce
SSDEEP

12288:yjWshi3UvdHNc5JQA2ur1e1ckv4y4TWKH2cgqUe:yjdzI5JXWX8C3HqN

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

pid process

3000 7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3000 7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

pid	process
3000	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3000	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

description	pid	process	target process
PID 3000 wrote to memory of 2604	3000	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
PID 3000 wrote to memory of 2604	3000	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
PID 3000 wrote to memory of 2604	3000	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
PID 3000 wrote to memory of 2604	3000	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe	7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7d39468c9c7a5e722cdf752071865924_JaffaCakes118.exe"
  2⤵
  PID:2604

memory/3000-0-0x00000000740D1000-0x00000000740D2000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x00000000740D0000-0x000000007467B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-22-0x00000000740D0000-0x000000007467B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-23-0x00000000740D0000-0x000000007467B000-memory.dmp

Filesize
5.7MB

Download