b83eb59b1615a1902f64021171f0a9d893897cb388c8325caa30a9f8ecbccf90

Analysis

max time kernel
9s
max time network
10s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 22:54

Reason

Machine shutdown

Target

3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe
Size

24KB
MD5

3f331372f8fd8fb7b0be16c5adb1261b
SHA1

043befe5f869a106e011a12a866461a65e1cc404
SHA256

b83eb59b1615a1902f64021171f0a9d893897cb388c8325caa30a9f8ecbccf90
SHA512

cdcd7bf46d73128789b480d51906c6e3520897af7e7597d9da22dd120f52987c871e138b053d01b59466060df3f706db7b1caa11a4ae506ac2291fae4d770b8e
SSDEEP

192:cr62I3LEfmoFXzflItLkchee5MGBKVPNY688/Nw/v1fip1jRreX8r+MmrKUOG+Mv:cO2i2F7sMIKzbGSZmrKwZsTHkwxOA6

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2520	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2148	3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2148	3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2520	2148	3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2520	2148	3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2520	2148	3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2520	2148	3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f331372f8fd8fb7b0be16c5adb1261b_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3F3313~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2520

memory/1128-0-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2740-1-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download