fe0e23d858c44bbcfe32febdde659016ece01da2ba524970ca153a838fdd2324

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 16:21

Target

0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe
Size

314KB
MD5

0a595911b2be4c5c0ee861802be2a830
SHA1

e66b34d911944e675e3cad0613bcd24569adfa8b
SHA256

fe0e23d858c44bbcfe32febdde659016ece01da2ba524970ca153a838fdd2324
SHA512

0ae3920c694170d6dc445e1844f8cc561e9fa9ee44f62cbf4feecc7c3560c25be10eb9f1809eaf8e12a7a1963ccaf539f35e746a66026e28697204b152c3d6a4
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j79:MLry/neyx7f/A64j79

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
872	txkbbxlubnxpst.exe

Loads dropped DLL 1 IoCs

pid	Process
1440	0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bkrlnzylh\txkbbxlubnxpst.exe	0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 872	1440	0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe	28
PID 1440 wrote to memory of 872	1440	0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe	28
PID 1440 wrote to memory of 872	1440	0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe	28
PID 1440 wrote to memory of 872	1440	0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a595911b2be4c5c0ee861802be2a830_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\bkrlnzylh\txkbbxlubnxpst.exe
  "C:\Program Files (x86)\bkrlnzylh\txkbbxlubnxpst.exe"
  2⤵
  - Executes dropped EXE
  PID:872

\Program Files (x86)\bkrlnzylh\txkbbxlubnxpst.exe

Filesize
339KB

MD5
f5f5080ff361d0fd49553915ffed6f7b

SHA1
73136939c455c5c192182cbcb886024f03418b99

SHA256
9784362a475be3b2af967c5aeedff8c2f9aa2e3a8db2bf7d26529ab4eee807b6

SHA512
334e0417dab60859f07cf71c5b96f6b82f74843e8999fb2effc1b250036dff22a144b129204258488a4dccbd75832a68ab9f10952d84127ca4e4b5a8f4d2b37c

Download Submit
memory/872-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/872-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1440-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1440-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1440-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download