ae498258f795e68ca122bab6f3714246f889bb9162a506d84bacad8f7384ae50

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 07:19

Target

48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe
Size

133KB
MD5

48c64eb23e3b0f1ded5c9980b1e7f0f1
SHA1

7e055096a8678f68b7d6a5749682191ea9f934c8
SHA256

ae498258f795e68ca122bab6f3714246f889bb9162a506d84bacad8f7384ae50
SHA512

459ecad186ce42d221e3725baa0428a4ac1909e91ac1c178035b094606511ec1df5335c75d34c3f5a47538ddecf9eb6a19d8b2576024492956588284cb148917
SSDEEP

3072:me44Gz4N94fNLki8W2cnBR02Mwbr0EmG//lxTo46QXMmAItI:44GWin8CO2Trs4HMK

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
2036	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2036	1944	48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2036	1944	48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2036	1944	48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2036	1944	48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48c64eb23e3b0f1ded5c9980b1e7f0f1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -f -im ashMaiSv.exe -im McShield.exe -im oasclnt.exe -im mcagent.exe -im McVSEscn.exe -im mcvsftsn.exe -im Mcdetect.exe -im McTskshd.exe -im mcvsshld.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036

C:\Users\Admin\AppData\Local\Temp\Cab2CEC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D2D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1944-322-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download