94d061976f1bfc6f56cfacec9e19a87e9e553fb2fd99f67900cf71a72d348a3b

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 11:04

Target

0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe
Size

2.2MB
MD5

0ba173af7380bbe70d970caec82ffc36
SHA1

8d5e57a20617d338fdf05c7c6b69a974c6193418
SHA256

94d061976f1bfc6f56cfacec9e19a87e9e553fb2fd99f67900cf71a72d348a3b
SHA512

2f5e1ae195fb6ea6c99b9c21fc90bb9c68c551e215f7ecf0dd8ac3da615bb4562ed1de7b0dd96dcc828b980fd4a5e87a6559388ec1ee640c7f119177ad659a72
SSDEEP

24576:oAHnh+eWsN3skA4RV1Hom2KXMmHaMk672qqWe4SIftv7ULgPiyuooUv05:vh+ZkldoPK8YaM1S

Score

1^/10

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe

pid	Process
2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe
2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe
2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe

pid	Process
2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe
2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe
2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3036	2368	0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ba173af7380bbe70d970caec82ffc36_JaffaCakes118.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3036

memory/3036-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download