0c68c370dec1afd10dc8a719b03054ea30a1f91854331e63f1b7d7444636df00

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 15:03

Target

399e598674552d5b216622d087c7b166_JaffaCakes118.exe
Size

181KB
MD5

399e598674552d5b216622d087c7b166
SHA1

a58ffd057be6792c4da497cbcaf8374f9b7f7823
SHA256

0c68c370dec1afd10dc8a719b03054ea30a1f91854331e63f1b7d7444636df00
SHA512

d5eed72b648d6137a9cb92d35c2cbfb03400da2a5b302565100aefed8b140bfd066481ffd33beabeb8a936845a6cf3ddbf8ebe451c5705c068dcd74697505bd1
SSDEEP

3072:cP+6vmdym9lKSsPr3uUrlhDM1T36znpi11tx5LY/mx1+xpMzSEK:cPdvay7uUr4p36znpgxUmWxpMzSE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3724	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 3724	1100	399e598674552d5b216622d087c7b166_JaffaCakes118.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	399e598674552d5b216622d087c7b166_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3724	1100	399e598674552d5b216622d087c7b166_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3724	1100	399e598674552d5b216622d087c7b166_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3724	1100	399e598674552d5b216622d087c7b166_JaffaCakes118.exe	86
PID 1100 wrote to memory of 3724	1100	399e598674552d5b216622d087c7b166_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\399e598674552d5b216622d087c7b166_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\399e598674552d5b216622d087c7b166_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:3724

memory/1100-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1100-1-0x0000000002180000-0x00000000021AA000-memory.dmp

Filesize
168KB

Download
memory/1100-3-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1100-4-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1100-2-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1100-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1100-6-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1100-7-0x0000000002180000-0x00000000021AA000-memory.dmp

Filesize
168KB

Download