834d4417c20b581de2c262d0375e89304790a4252a065aaebf49ec49a1ca8709

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 20:06

Target

1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe
Size

962KB
MD5

1c54d6e5e127d90e9443c27b01a87ab8
SHA1

1e5c559a7101f1bc8033e8c72e71174ccab23e75
SHA256

834d4417c20b581de2c262d0375e89304790a4252a065aaebf49ec49a1ca8709
SHA512

73b41f9c9c52544da5fe3f75327143cc8a926b0bf958634cfa670834cce1a4775c1910393e817268676609a24cdccd22983ba04bc3363fa1277cb362f22f8e21
SSDEEP

24576:jxeOI/RUsMTX26XoY8odUeBzQBHfW4eo0NLp4BaPJ:BYKfRYYhdUeB8HfLeod

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 996	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe	82
PID 3096 wrote to memory of 996	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe	82
PID 3096 wrote to memory of 996	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe	82
PID 3096 wrote to memory of 1216	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe	83
PID 3096 wrote to memory of 1216	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe	83
PID 3096 wrote to memory of 1216	3096	1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe
  1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe
  1c54d6e5e127d90e9443c27b01a87ab8_JaffaCakes118.exe
  2⤵
  PID:1216

memory/3096-0-0x0000000074C12000-0x0000000074C13000-memory.dmp

Filesize
4KB

Download
memory/3096-1-0x0000000074C10000-0x00000000751C1000-memory.dmp

Filesize
5.7MB

Download
memory/3096-2-0x0000000074C10000-0x00000000751C1000-memory.dmp

Filesize
5.7MB

Download
memory/3096-4-0x0000000074C10000-0x00000000751C1000-memory.dmp

Filesize
5.7MB

Download