ca1bffd23fd3b17d8b0f78c59f5a93732dff2e1d5d15e7be40f0b632ffa518da

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 15:19

Target

8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
Size

724KB
MD5

8ae11269fe05eb3a4a6a101dee96723a
SHA1

f27fde7c0ac091d89aedff8dc1e44fbea0e7f430
SHA256

ca1bffd23fd3b17d8b0f78c59f5a93732dff2e1d5d15e7be40f0b632ffa518da
SHA512

2da621d54384f57aaec5c24cf1a180b116ec613de1cd21409b7afd1b32daf5f41df9a721be3890e8aa231fc71dd3d013c8ca4dc85b5914171f3fe964721c88c8
SSDEEP

12288:NtmONn+T+sXmg7JleKLAe47Y9Pt/OQE+H7FQD4Bq47:nmONaXReVeuYDWSBQ8B9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4956	3468	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe	84
PID 3468 wrote to memory of 4956	3468	8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\8ae11269fe05eb3a4a6a101dee96723a_JaffaCakes118.exe
  2⤵
  PID:4956

memory/3468-0-0x00007FF8F2D25000-0x00007FF8F2D26000-memory.dmp

Filesize
4KB

Download
memory/3468-1-0x00007FF8F2A70000-0x00007FF8F3411000-memory.dmp

Filesize
9.6MB

Download
memory/3468-2-0x0000000000D40000-0x0000000000D52000-memory.dmp

Filesize
72KB

Download
memory/3468-3-0x000000001B690000-0x000000001B736000-memory.dmp

Filesize
664KB

Download
memory/3468-4-0x00007FF8F2A70000-0x00007FF8F3411000-memory.dmp

Filesize
9.6MB

Download
memory/3468-6-0x00007FF8F2A70000-0x00007FF8F3411000-memory.dmp

Filesize
9.6MB

Download