ce5f10830d3f40ced5a92d010e32593511970eb5e9c762b489acd753c8a88fcd

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 20:17

Target

f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe
Size

719KB
MD5

f1d6241f237a1757e13ae82585e392c5
SHA1

3bb46f056ad979c6ca7a7c6469a907f42441ee84
SHA256

ce5f10830d3f40ced5a92d010e32593511970eb5e9c762b489acd753c8a88fcd
SHA512

9048320cf26542f0b8054762e61430784420e90fd6940ec91a4009d5cd436201981d8924ac62e8dc658e181dbdbef100965a281df5859c127a8458fa737a0789
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVYhtl8KB0J4pEC7mF:qKeyxTAJj7P+yW6mc1YVt1BUN9

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1664	iggzzxoqhht.exe

Loads dropped DLL 1 IoCs

pid	Process
2632	f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\nkroydpobg\iggzzxoqhht.exe	f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1664	2632	f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe	28
PID 2632 wrote to memory of 1664	2632	f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe	28
PID 2632 wrote to memory of 1664	2632	f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe	28
PID 2632 wrote to memory of 1664	2632	f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1d6241f237a1757e13ae82585e392c5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\nkroydpobg\iggzzxoqhht.exe
  "C:\Program Files (x86)\nkroydpobg\iggzzxoqhht.exe"
  2⤵
  - Executes dropped EXE
  PID:1664

\Program Files (x86)\nkroydpobg\iggzzxoqhht.exe

Filesize
738KB

MD5
9918a0ba9f9569c3fef7f71aaba8d9ab

SHA1
5919d3ba93a9e829169c5ff03913b6c4623bace6

SHA256
fb2c36efd3a95ad7121bb6c7c6538d2b104383c5699f449404dd75172a5561c0

SHA512
235f85b767885241dda8a7f220d59013a6256792bacfc22bbc2cb7df82d2bd9995347d7d82612190ff7238971510e324b56f8bedbdc4b24b88763444560ce52b

Download Submit
memory/1664-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1664-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2632-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2632-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download