d8ed1e4fedf3d4d7fcfe13596df07253ee4f084722940a2f19bdd6c2ce90d380

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 21:18

Target

320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
Size

171KB
MD5

320388775a02869ae2dc5c162b3fa112
SHA1

74dbcb2c8a0b65c885ef8208f25a8b792ef60581
SHA256

d8ed1e4fedf3d4d7fcfe13596df07253ee4f084722940a2f19bdd6c2ce90d380
SHA512

65ae4accf1c0116935ea13b72e1c0485a84e43283ddd3a780dc1b8a6b62c2dc1c78233995e66283912c45395f6715adf056093bc81edd338dcb36b8128434903
SSDEEP

3072:8EpI/23fuWBf/GtCgmaMLrAcVFDH6Ghahs0AORUe:XIfxtxQPeG8hLT5

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	whatismyip.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2040	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	84
PID 628 wrote to memory of 2040	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	84
PID 628 wrote to memory of 4016	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	85
PID 628 wrote to memory of 4016	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	85
PID 628 wrote to memory of 1104	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	86
PID 628 wrote to memory of 1104	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	86
PID 628 wrote to memory of 1004	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	87
PID 628 wrote to memory of 1004	628	320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  2⤵
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\320388775a02869ae2dc5c162b3fa112_JaffaCakes118.exe
  2⤵
  PID:1004

memory/628-0-0x00007FFA0D733000-0x00007FFA0D735000-memory.dmp

Filesize
8KB

Download
memory/628-1-0x00000000009C0000-0x00000000009EE000-memory.dmp

Filesize
184KB

Download
memory/628-2-0x00007FFA0D730000-0x00007FFA0E1F1000-memory.dmp

Filesize
10.8MB

Download
memory/628-3-0x00007FFA0D730000-0x00007FFA0E1F1000-memory.dmp

Filesize
10.8MB

Download
memory/628-4-0x00007FFA0D730000-0x00007FFA0E1F1000-memory.dmp

Filesize
10.8MB

Download
memory/628-19-0x0000000020590000-0x0000000020D36000-memory.dmp

Filesize
7.6MB

Download
memory/628-35-0x000000001C760000-0x000000001CEB7000-memory.dmp

Filesize
7.3MB

Download
memory/628-37-0x00007FFA0D733000-0x00007FFA0D735000-memory.dmp

Filesize
8KB

Download
memory/628-38-0x00007FFA0D730000-0x00007FFA0E1F1000-memory.dmp

Filesize
10.8MB

Download