8250d0513e843d025f6e56dbc447d6e98818fe538df745dc9e10263ae51e58e9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 23:59

Target

5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe
Size

7KB
MD5

5c2a1e4067a879d87e3c28a82feb99a2
SHA1

6312de8ee2b3239418a36186b8c9b63229a70093
SHA256

8250d0513e843d025f6e56dbc447d6e98818fe538df745dc9e10263ae51e58e9
SHA512

af50846f41d4182fee9dc8691d28eba817136e7dd536f773f8a2243201f17ef909c6d3cf12933df761686486f0b148ec9cb97c2e4016bde7d094f2736b7afee5
SSDEEP

192:U6SUaIoYFZcKMhZOdyo58+UqWeqjfFBTb1:U6SnIoYE7kEo58+UqWrNl

Score

6^/10

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	wtfismyip.com
5	wtfismyip.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	2924	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2624	2924	5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 2624	2924	5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 2624	2924	5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 2624	2924	5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c2a1e4067a879d87e3c28a82feb99a2_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 1264
  2⤵
  - Program crash
  PID:2624

memory/2924-0-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2924-2-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2924-3-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download