7fbdd5d5f0fb20ebfd8cbd5acbdd917c3d54e373d6ec1f5e4915f534cdfa7659

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 14:05

Target

229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe
Size

192KB
MD5

229fbc574a60f3791a98ce353db72768
SHA1

aac2484cf30b21d35dcddb59c1b1d5031a6df28a
SHA256

7fbdd5d5f0fb20ebfd8cbd5acbdd917c3d54e373d6ec1f5e4915f534cdfa7659
SHA512

d9063486dac4661c5c6cb1504d882e12de618a3f86f60452ff4529f407ecf8152a092adba996b26e14771ebc7d6aa6a95bdc5454eafbe28b929994480e7527c6
SSDEEP

3072:SBzICFXzr6DL1geR28kbivWpZDC+Dq/4B/wFj2wu2I:sD6DLvR28gppI5

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2016	1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe	28
PID 1760 wrote to memory of 2016	1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe	28
PID 1760 wrote to memory of 2016	1760	229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\229fbc574a60f3791a98ce353db72768_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 532
  2⤵
  PID:2016

memory/1760-0-0x000007FEF5E3E000-0x000007FEF5E3F000-memory.dmp

Filesize
4KB

Download
memory/1760-1-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-2-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-3-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-4-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-6-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/2016-5-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download