aa6a1252137858969d62a2ab8f663cae3254725f687f42a4dd8fb9a2de5bc888

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:24

Target

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe
Size

1.1MB
MD5

65d74edf5d5f32f01f74d9638bb3a529
SHA1

4fc01b1b0ca33a1ceabb345f7d709855d372251b
SHA256

aa6a1252137858969d62a2ab8f663cae3254725f687f42a4dd8fb9a2de5bc888
SHA512

1f6c0bd921fa7370a0b2f0d15c015cda3050d10ffe536288ee6e0effd830400a79ec539bfb42509f26c9857571d52e8c9a97f791300832ebbd828938d77a145e
SSDEEP

24576:TQiZ5X0K8+81OfIIhyEqWN50NxIYxxsvLcLdi/XKxSPpfsQqyGlR53:T9zs8ITg50/XeQLdi/XKxSPpfsJyGlRd

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid process

2176 65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid	process
2176	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

Processes:

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid	process
2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe
2176	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
2176	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid process

2176 65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

pid	process
2176	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe

description	pid	process	target process
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
PID 2072 wrote to memory of 2176	2072	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.exe	65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp

\Users\Admin\AppData\Local\Temp\is-38RVE.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-HS5B1.tmp\65d74edf5d5f32f01f74d9638bb3a529_JaffaCakes118.tmp
Filesize
699KB

MD5
42bc0a6e911179bb0cbf0d2445c8db8b

SHA1
9e865d759d14cfaf00578779baed491be311f946

SHA256
e56f4e8207b00ae6decf5aa890815c4a2acde5abb2fa336e2a2a5d739fa55a3a

SHA512
b837dcd51d28856fbac7dda820f192610f9c42753e4c3b93cbe0b47f3bbaa3fa0b985ef9e164715516c47cde3dbc7c3534b1e99924f7aa7d39111ea55cf7259d

Download Submit
memory/2072-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2072-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2072-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2176-9-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2176-16-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download