98e8d24e2208d35a9e07db9e4498638b10fe1a05e2de7b676e58b6616e7e6497

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 14:15

Target

f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe
Size

1.6MB
MD5

f3a9c0dc8b3f617d8fab72fac13ab906
SHA1

0de97184e1728e6b25686b9047d53f5141cf4cf9
SHA256

98e8d24e2208d35a9e07db9e4498638b10fe1a05e2de7b676e58b6616e7e6497
SHA512

95f48ef44cfa33b25d3106bd0a30148cbb6b46b6b0c0989d11119cd18174b2fd78e41c13ab54ce150144217f9789b3bd59b5edf50991864e9cb1abeaccd989f2
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRWs0:dqgazxcGYN139lnk30r90

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1744	zaz.exe

Loads dropped DLL 1 IoCs

pid	Process
2356	f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\llymea\zaz.exe	f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1744	2356	f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1744	2356	f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1744	2356	f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1744	2356	f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3a9c0dc8b3f617d8fab72fac13ab906_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\llymea\zaz.exe
  "C:\Program Files (x86)\llymea\zaz.exe"
  2⤵
  - Executes dropped EXE
  PID:1744

\Program Files (x86)\llymea\zaz.exe

Filesize
1.6MB

MD5
2c698dc4eb4c3bc52c8330b849ee5b88

SHA1
d88215c149e8640709e086c1e6c04480daf14971

SHA256
0e6c8a624e46971b8c43aa26ec4a26c1fbf32a116278bd388ae1c4636759f88c

SHA512
3e688ceac5ad396bb00d78ca408a218781a5808b2b45e5a0675e8f301205e32a3e97535a0800061ed32e0bdac9a5c5c056c386dc3c2cbc1ffbfa91c39bb7f106

Download Submit
memory/1744-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2356-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download