264d4205f78d92c01f2167825dc9a92793e636e989a173680d2da5e3127a6b6d

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 07:41

Target

16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
Size

159KB
MD5

16c7252aba847c9140ab2bca18c37b80
SHA1

1196668a1e5cec64da324a34deca43944d5db9b4
SHA256

264d4205f78d92c01f2167825dc9a92793e636e989a173680d2da5e3127a6b6d
SHA512

6ef9369eb06fb74411429ca045f4c85a1b985f9588ac14cc32b959ebffff668e26f003d1c287798da11cf3bd07dca2f4da5d2bcc5c587cf7d0eee57418b11544
SSDEEP

3072:jJd/0It0/czNgSAObIJ0Fn3IeGRmfCxVgf2mhCnhKKLwXjrKLwfkd70nIJgjL0cY:jJd/peUgAbBF3IOfCS2mhCAKM6Lwyw0n

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2768	2248	16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\16c7252aba847c9140ab2bca18c37b80_JaffaCakes118.exe
  16c7252aba847c9140ab2bca18c37b80_JaffaCakes118
  2⤵
  PID:2768

memory/2248-0-0x000007FEF5BAE000-0x000007FEF5BAF000-memory.dmp

Filesize
4KB

Download
memory/2248-1-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-2-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/2248-3-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-4-0x0000000000560000-0x000000000058A000-memory.dmp

Filesize
168KB

Download
memory/2248-5-0x0000000000690000-0x00000000006BA000-memory.dmp

Filesize
168KB

Download
memory/2248-6-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-11-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download