2fdcb6638ccfeecf82e4afb8daf66d165b066d59b1c387ca4363b3079d044dfd

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 23:28

Target

f6cdd9c1d7a338f8f7ff421c761381d7_JaffaCakes118.exe
Size

41KB
MD5

f6cdd9c1d7a338f8f7ff421c761381d7
SHA1

0ad004dbcb9701e4b51a14c50096053e900851d8
SHA256

2fdcb6638ccfeecf82e4afb8daf66d165b066d59b1c387ca4363b3079d044dfd
SHA512

c5c8e88ec3bdc672a8b9964aca06738cb4390763ada39550df743ef87ca215b69f0ecac113d8a824d5870805354469f937d0e2c3471eea5733fccbe3743974c6
SSDEEP

768:GyhyDFwh1D34Ts26dvB10Jd/zIwCVOVDmUqV3LCVOV3VC/CIf+:GyoA1D34Ts26dvB1UXW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2000	foodwic.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2000	2772	f6cdd9c1d7a338f8f7ff421c761381d7_JaffaCakes118.exe	84
PID 2772 wrote to memory of 2000	2772	f6cdd9c1d7a338f8f7ff421c761381d7_JaffaCakes118.exe	84
PID 2772 wrote to memory of 2000	2772	f6cdd9c1d7a338f8f7ff421c761381d7_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\f6cdd9c1d7a338f8f7ff421c761381d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6cdd9c1d7a338f8f7ff421c761381d7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\foodwic.exe
  C:\Users\Admin\AppData\Local\Temp\foodwic.exe
  2⤵
  - Executes dropped EXE
  PID:2000

C:\Users\Admin\AppData\Local\Temp\foodwic.exe

Filesize
41KB

MD5
60feb9d165f5d2e8f160be3e90b5fac6

SHA1
8cdae05934425eb3e911c5b35ac1bf7461186755

SHA256
d9051b49fd6b0b4bc43aed8e2306a9484dad6a10a458335dff269d99d963c0c7

SHA512
1ea58244c28947ae100f1c39f14109bb71e2569a3a5e1360ec287a8fe4ab5138a7aa28288259c1ac477e276e6f0e54bcd354f59c5321a6bee839cdb1b07d28f9

Download Submit
memory/2000-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2772-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download