4c4de8749c5f52e3ae95921bdd3f5142b3a5bd53ae101d33b15a006117a6a097

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 22:29

Target

fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe
Size

77KB
MD5

fb4e97fffcec9124fea75fa0474637f1
SHA1

ed85876d34d85fe7d80cf93cb80823573bc2d7e2
SHA256

4c4de8749c5f52e3ae95921bdd3f5142b3a5bd53ae101d33b15a006117a6a097
SHA512

577ec5e56068ca55c6b35c448deace1d9b9c02f423ff1932a87c3a05427bf500afca3fac4b566a15dee1226507e28c6535f7b1cb1113c8f8d70f664a610f32a3
SSDEEP

1536:T71q+1QTyimXNJlizBKKBafzYID1fJKcvfiVqstjhX07TISGQlaAs/6nQFQUd5O:r1uyXXj+7S8ID1fnavt1E7TEQkAs/6sl

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2148	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mjcs.exe	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mjcs.exe	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe
2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1212	2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe	21
PID 2984 wrote to memory of 2148	2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2148	2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2148	2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2148	2984	fb4e97fffcec9124fea75fa0474637f1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\clear.bat

Filesize
118B

MD5
c04d217ccee80b979cafa5f420607b2b

SHA1
a347cf779b0d34f42e52c5262d222a62cc6d9b00

SHA256
1286f1a5415c5e9b3e7215cca2e1fe48b7dafeb7b33cd54455a28001cffe11c3

SHA512
ae51e11ebe621db4caa14294bcc4ddd562954e720784aae3f0ff46bda1f3625e3c34c89353b965385c7ca547c307410cd9d435d86ce78409da1f9f1a2593c938

Download Submit
memory/1212-0-0x0000000013130000-0x000000001314A000-memory.dmp

Filesize
104KB

Download
memory/2984-10-0x0000000013130000-0x000000001314A000-memory.dmp

Filesize
104KB

Download