17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 10:04

Target

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
Size

840KB
MD5

8a2123d4809ffdc677df37b88d58769c
SHA1

4138f2da78ccf7ed3a07d455fddb367f59568d04
SHA256

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80
SHA512

632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671
SSDEEP

12288:juCJUOVMQGZGlScgjAFai8/6CAYUNifucTSkPjQMS/kkkkkkk:jNJUOVbocgjA58SCAi2jkPh

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4416 8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4416	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

description	pid	process	target process
PID 4416 wrote to memory of 2868	4416	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 4416 wrote to memory of 2868	4416	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 4416 wrote to memory of 2868	4416	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2868

memory/4416-0-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

Filesize
4KB

Download
memory/4416-1-0x00000000007A0000-0x0000000000878000-memory.dmp

Filesize
864KB

Download
memory/4416-2-0x00000000051D0000-0x00000000051E8000-memory.dmp

Filesize
96KB

Download
memory/4416-3-0x00000000052B0000-0x0000000005342000-memory.dmp

Filesize
584KB

Download
memory/4416-4-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download
memory/4416-5-0x0000000005900000-0x0000000005EA4000-memory.dmp

Filesize
5.6MB

Download
memory/4416-6-0x00000000053A0000-0x00000000053E4000-memory.dmp

Filesize
272KB

Download
memory/4416-7-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Filesize
408KB

Download
memory/4416-8-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

Filesize
4KB

Download
memory/4416-9-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download
memory/4416-11-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download
memory/4416-12-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download