1519fe4eb9ca26d90225786ee1e3cf5d68b66f8fffbf8a226a92c33aafc4a475

Analysis

max time kernel
128s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:59

Target

19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe
Size

44KB
MD5

19343b2df97aebdf50179fe1d4e3b5fa
SHA1

543e76236f10f495586fe052d0d6d66d43dbfc7e
SHA256

1519fe4eb9ca26d90225786ee1e3cf5d68b66f8fffbf8a226a92c33aafc4a475
SHA512

c88fd9c71c3fea1c9aa942014d61660d60b0c912ef0043ba074dede434d9b771607c9a34643b24068656bbc420b2dacab4d9351cc7b848a08a407ec5a3803268
SSDEEP

768:FtNaTOvfb/8TyA+4wHqTNcByD+jsMmFIrgQWabJ8sUuEoxNolxG/i:FSiXzsjoHECj3mFrwJ8jOM4/i

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\llycuss32.exe	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\llycuss32.exe	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3688	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe
3688	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82
PID 808 wrote to memory of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82
PID 808 wrote to memory of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82
PID 808 wrote to memory of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82
PID 808 wrote to memory of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82
PID 808 wrote to memory of 3688	808	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	82
PID 3688 wrote to memory of 3448	3688	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	56
PID 3688 wrote to memory of 3448	3688	19343b2df97aebdf50179fe1d4e3b5fa_JaffaCakes118.exe	56

memory/808-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/808-2-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/808-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3688-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3688-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3688-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3688-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download