parallax | 60ef9eb3bf8715d7d8bae33a2282bc3f35598582f9e70847fec56293f580e15c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 03:48

Target

2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe
Size

9KB
MD5

2adf99600e9fc97a899b06fde2fad180
SHA1

63806f53ab4e3f1a49ccf0643eb18e60878b25c8
SHA256

60ef9eb3bf8715d7d8bae33a2282bc3f35598582f9e70847fec56293f580e15c
SHA512

d6c43346de406aed363574b80c47b15e8a0b4c22015028f467816e63a52acccaaa857d1335b47f823d6b0db153340fdb2bed16d7a42b5eeb59f638b310e821bb
SSDEEP

192:1Lnd3kQiatb6G8Z9/7OVlnlYJLuLTfynK4EiWHB+ORnGoM:1Lnd3kgb6f96w6LTfyKjiWhV4oM

Score

10^/10

parallax rat

Executes dropped EXE 1 IoCs

pid	Process
1964	winsvchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe
2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1964	2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe	30
PID 2084 wrote to memory of 1964	2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe	30
PID 2084 wrote to memory of 1964	2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe	30
PID 2084 wrote to memory of 1964	2084	2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2adf99600e9fc97a899b06fde2fad180_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Roaming\Security\winsvchost.exe
  C:\Users\Admin\AppData\Roaming\Security\winsvchost.exe
  2⤵
  - Executes dropped EXE
  PID:1964

\Users\Admin\AppData\Roaming\Security\winsvchost.exe

Filesize
9KB

MD5
2adf99600e9fc97a899b06fde2fad180

SHA1
63806f53ab4e3f1a49ccf0643eb18e60878b25c8

SHA256
60ef9eb3bf8715d7d8bae33a2282bc3f35598582f9e70847fec56293f580e15c

SHA512
d6c43346de406aed363574b80c47b15e8a0b4c22015028f467816e63a52acccaaa857d1335b47f823d6b0db153340fdb2bed16d7a42b5eeb59f638b310e821bb

Download Submit
memory/1964-13-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-14-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-15-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-17-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-18-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2084-0-0x0000000074491000-0x0000000074492000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2084-2-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2084-16-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download