5334316e9e7d96c02fdc9035c71b342fc4333162eedc242293ccab2598885ba5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 06:20

Target

0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe
Size

130KB
MD5

0cfeb1b421f6809b844e39712b3dde4e
SHA1

e64ef821c214ea94e9867acf8f76d74ab61d2ad3
SHA256

5334316e9e7d96c02fdc9035c71b342fc4333162eedc242293ccab2598885ba5
SHA512

d6419d75900dd009cbf8a739d4a59b60babc29c266ab0765c6f2ad8898b45d7e067421ae732f1b056c2507119cc109f35da84beffb121210e626a01fae3ce7df
SSDEEP

768:gRSNRlV0ktY8BDwVKrJLcdIFN+y3C6mTGep2UZEccJAPfTYolQ7eB8pGIy0O8y1Y:XNa/3iK8N+yS6mQQSUIXryCSwOKt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2336	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2336	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2336	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2336	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2336	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe	28
PID 2348 wrote to memory of 2336	2348	0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0cfeb1b421f6809b844e39712b3dde4e_JaffaCakes118.exe
  2⤵
  PID:2336

memory/2336-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-0-0x0000000074261000-0x0000000074262000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download
memory/2348-2-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download
memory/2348-5-0x0000000074260000-0x000000007480B000-memory.dmp

Filesize
5.7MB

Download