d77b5185cb9ee6f14b0dfffc147aca637fff8764c100d70090493b8f9851731f

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 20:51

Target

e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe
Size

928KB
MD5

e3419829c4e6f448ed4b26fe35ae6ce9
SHA1

902805b919c3e1f078eeb607889a01a75b29b49a
SHA256

d77b5185cb9ee6f14b0dfffc147aca637fff8764c100d70090493b8f9851731f
SHA512

2ab6eeafb3e694aba8100df44bcf0b18736fd5aab90d495cbf5646bfbd0db6715cb4a5e3692200992594a40ef83076045cc37d676c12dbbfd1e57258aa6b7feb
SSDEEP

12288:h1Wl8T5NM63xjmeRfdoZBgAWF2p3OGdUMXysKA/zXQ:hA27dxIgBF0OGdUkysLzXQ

Score

1^/10

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe

pid process

1720 e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe
1720 e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe

pid	process
1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe
1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe

description	pid	process	target process
PID 1720 wrote to memory of 1964	1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe	MSBuild.exe
PID 1720 wrote to memory of 1964	1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe	MSBuild.exe
PID 1720 wrote to memory of 1964	1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe	MSBuild.exe
PID 1720 wrote to memory of 1964	1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe	MSBuild.exe
PID 1720 wrote to memory of 1964	1720	e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\e3419829c4e6f448ed4b26fe35ae6ce9_JaffaCakes118.exe"
2⤵
PID:1964

memory/1720-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/1720-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1720-2-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download