f8c5d83d9692f7d250ad1a6ac45a22daed295b288e5b811a274af0b9f6217b17

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 13:06

Target

d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe
Size

223KB
MD5

d65f27ed7f7c386ec51256584c9f551e
SHA1

090409095c71744d3bc54747dbf72a1bb4cd7eaf
SHA256

f8c5d83d9692f7d250ad1a6ac45a22daed295b288e5b811a274af0b9f6217b17
SHA512

3e178d2da032bba5343af7a7aeb183bb6730e53bfca5f35b86cd8b85ae5075aee785640a609f44fba7581520d9c6f3aaa3283e07aae101ae93675f2e89001e01
SSDEEP

6144:/cwadtk5TP9vqZGl6STeg2AXV/f/+SFWtdZutp1van:UwAtkNdpFTRXfINC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2480	1620	d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2480	1620	d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2480	1620	d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d65f27ed7f7c386ec51256584c9f551e_JaffaCakes118.exe
  2⤵
  PID:2480

memory/1620-0-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download