c53206c1a2aced8b30f030654f9f430542102547a3afb934643d70a0f922ec8a

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 08:39

Target

046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
Size

320KB
MD5

046921c4ecde06ff83b50ce72ed32257
SHA1

b8f91e69ab1d632d2bc450d2c36b9db560956afe
SHA256

c53206c1a2aced8b30f030654f9f430542102547a3afb934643d70a0f922ec8a
SHA512

9fb0595536d344444facc61f6d7abc10f8932c6799bc323e20a7316d2e7dd2d1984329228a38f497a350713f3bec592d2a651542a2794b46682cba57efda63e9
SSDEEP

6144:qq6wzl1GCMsgICZnYNEwK/nzoJIGyxFNirwWSP/VlFI:qfwLG7jlfDNirwWS3FI

Score

8^/10

evasion

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
Token: SeDebugPrivilege	3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 368	3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe	90
PID 3504 wrote to memory of 368	3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe	90
PID 3504 wrote to memory of 368	3504	046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\046921c4ecde06ff83b50ce72ed32257_JaffaCakes118.exe" nfaddtdsdqaohwozdij
  2⤵
  PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2564,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
1⤵
PID:2272

memory/368-4-0x0000000000400000-0x0000000000453F00-memory.dmp

Filesize
335KB

Download
memory/368-2-0x0000000000400000-0x0000000000453F00-memory.dmp

Filesize
335KB

Download
memory/368-6-0x0000000000400000-0x0000000000453F00-memory.dmp

Filesize
335KB

Download
memory/3504-0-0x0000000000400000-0x0000000000453F00-memory.dmp

Filesize
335KB

Download
memory/3504-1-0x0000000002350000-0x0000000002760000-memory.dmp

Filesize
4.1MB

Download
memory/3504-3-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3504-7-0x0000000000400000-0x0000000000453F00-memory.dmp

Filesize
335KB

Download