ca1bffd23fd3b17d8b0f78c59f5a93732dff2e1d5d15e7be40f0b632ffa518da

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 15:19

Target

8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
Size

724KB
MD5

8ae11269fe05eb3a4a6a101dee96723a
SHA1

f27fde7c0ac091d89aedff8dc1e44fbea0e7f430
SHA256

ca1bffd23fd3b17d8b0f78c59f5a93732dff2e1d5d15e7be40f0b632ffa518da
SHA512

2da621d54384f57aaec5c24cf1a180b116ec613de1cd21409b7afd1b32daf5f41df9a721be3890e8aa231fc71dd3d013c8ca4dc85b5914171f3fe964721c88c8
SSDEEP

12288:NtmONn+T+sXmg7JleKLAe47Y9Pt/OQE+H7FQD4Bq47:nmONaXReVeuYDWSBQ8B9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2820	2292	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2820	2292	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2820	2292	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
  2⤵
  PID:2820

memory/2292-0-0x000007FEF614E000-0x000007FEF614F000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/2292-2-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download