2cf845e749b203ab8fa9d78d368965de3ee33822753d8b9ebaab939f83e631f6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 00:27

Target

f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe
Size

42KB
MD5

f918c9db38219f0f541b68ba924a7bac
SHA1

3acd88630d7dbc035a8c9cb62846cb07066f9b2c
SHA256

2cf845e749b203ab8fa9d78d368965de3ee33822753d8b9ebaab939f83e631f6
SHA512

0a657ee6e53c4ca1816002c21f872d4f1874cc57dc7573cc38e21d290e6dd1433368c5b80d21ffb7d474ccbf61f7b00c3541572edc9a83911917ff3be228cbe0
SSDEEP

768:pzIXe/KSYbzMi5dIikLYtRblI+zIXX+nnCbfIeBcGwBUuzmraMmr1b:lI6KSYbzMidk6Rbl/CAG8Uum41

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t1oiidt98o.exe	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t1oiidt98o.exe	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28
PID 2196 wrote to memory of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28
PID 2196 wrote to memory of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28
PID 2196 wrote to memory of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28
PID 2196 wrote to memory of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28
PID 2196 wrote to memory of 3048	2196	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	28
PID 3048 wrote to memory of 1196	3048	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	21
PID 3048 wrote to memory of 1196	3048	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	21
PID 3048 wrote to memory of 1196	3048	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	21

memory/1196-8-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/1196-9-0x0000000002EE0000-0x0000000002EE3000-memory.dmp

Filesize
12KB

Download
memory/1196-10-0x0000000002EF0000-0x0000000002EF2000-memory.dmp

Filesize
8KB

Download
memory/2196-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2196-1-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/2196-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3048-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download