9458150645831abec386a2cc631d5d5496afcb7f35faa9ba107200fa2e989ee7 | Triage

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 18:20

Sharing

Report Analysis Logs

General

Target

3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe
Size

34KB
MD5

3a3ecda4f9218f793cb3d816254adce1
SHA1

ca5623a3e1cf2e31f0329d64d2d985031e032904
SHA256

9458150645831abec386a2cc631d5d5496afcb7f35faa9ba107200fa2e989ee7
SHA512

097831f7e72f78912bab8132edcc7df088d9e8062f6e7f92dd681c0b92b046fc99a375489aba86d22796bf7706ac56446a2e3dc0a297af8b9385dc283615ccb7
SSDEEP

768:wqGYFNDtGQuBhgkX+ZCKrhnEDknAnby7YuW:tNBGQUiRwN9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
744	3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe
744	3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3532	744	3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3532
- C:\Users\Admin\AppData\Local\Temp\3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3a3ecda4f9218f793cb3d816254adce1_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads