6819a8754818eda0ca7efe9a57010b42a4f25b261b0dc0655b9327836afa3976

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 10:59

Target

3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe
Size

22KB
MD5

3019d89f3569a2d8ec69200ab6e2b355
SHA1

871e72fa9cc1407f87fe1dd1e545d0992749a320
SHA256

6819a8754818eda0ca7efe9a57010b42a4f25b261b0dc0655b9327836afa3976
SHA512

3ad5555d5334b76446a354251b14bb652d1ba0af1db1cc213e4a81730065c39732aba247bb44e01a5823fbde73ab3b77a02d9cd1f016e8264050636d9683e39b
SSDEEP

384:9MaVasm3Gg3Qa2oiE9WjQH5Y2wzgpovdT1NwTsBHwsg:9JVaXQa2GYlbTTweHQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4224	McxSvci.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\McxSvci.exe	3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\McxSvci.exe	3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3820	3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 1704	3820	3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe	83
PID 3820 wrote to memory of 1704	3820	3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe	83
PID 3820 wrote to memory of 1704	3820	3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3019d89f3569a2d8ec69200ab6e2b355_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3019D8~1.EXE > nul
  2⤵
  PID:1704

C:\Windows\SysWOW64\McxSvci.exe

Filesize
22KB

MD5
3019d89f3569a2d8ec69200ab6e2b355

SHA1
871e72fa9cc1407f87fe1dd1e545d0992749a320

SHA256
6819a8754818eda0ca7efe9a57010b42a4f25b261b0dc0655b9327836afa3976

SHA512
3ad5555d5334b76446a354251b14bb652d1ba0af1db1cc213e4a81730065c39732aba247bb44e01a5823fbde73ab3b77a02d9cd1f016e8264050636d9683e39b

Download Submit