a17d544460b89db4c2bdd510fab0d85fdc5c60ddd9961269260ae7841f74aa24

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:59

Target

3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe
Size

1.4MB
MD5

3eee4d8dc6443fa36c4e2ed6f328a63f
SHA1

a00968caa45217495e2cdc9ebaf1b289d33d125e
SHA256

a17d544460b89db4c2bdd510fab0d85fdc5c60ddd9961269260ae7841f74aa24
SHA512

b84fd8a22fa8e1535d36a487aa87c518fb4639a9504a372206eb08b89bf49838ecbe570894b9f871344dbd17f410cc13c4b019034aee03fd24cd6da9ea9878d5
SSDEEP

24576:3QhqG4C2GjOd4au4F9sxo6R0NTRI/fHHz4Gp7cOCNfOS:SatNTRqEGp72N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	2744	WerFault.exe	88

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2744	3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe
2744	3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3eee4d8dc6443fa36c4e2ed6f328a63f_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 3132
  2⤵
  - Program crash
  PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2744 -ip 2744
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:4676

memory/2744-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x0000000000AD0000-0x0000000000C30000-memory.dmp

Filesize
1.4MB

Download
memory/2744-2-0x00000000055D0000-0x000000000566C000-memory.dmp

Filesize
624KB

Download
memory/2744-3-0x0000000005CC0000-0x0000000006264000-memory.dmp

Filesize
5.6MB

Download
memory/2744-4-0x00000000057B0000-0x0000000005842000-memory.dmp

Filesize
584KB

Download
memory/2744-5-0x0000000005670000-0x000000000567A000-memory.dmp

Filesize
40KB

Download
memory/2744-6-0x0000000005710000-0x0000000005766000-memory.dmp

Filesize
344KB

Download
memory/2744-7-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2744-8-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2744-9-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2744-11-0x0000000009040000-0x0000000009394000-memory.dmp

Filesize
3.3MB

Download
memory/2744-22-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2744-24-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download