32a3bbc3782c8baadbfa071d1b1eb8ad579ab4265fe0f122d545f19a7443e1a7

Analysis

max time kernel
132s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:05

Target

68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe
Size

224KB
MD5

68744e8157ff48fcc69df39ff7156e5a
SHA1

578fcb70a3e7eef21706aface343c6d5a8da5517
SHA256

32a3bbc3782c8baadbfa071d1b1eb8ad579ab4265fe0f122d545f19a7443e1a7
SHA512

d9d940bbf62c82c8dd818df42d8ebef43b2c263029bd2c0286dcf6173fdb0472a482017bdb044d66f147b9c0e0fb5186f29d46375464fa1246a54e9c853759f9
SSDEEP

3072:vM9jG0zeb+Bd7ljqaULpJKV/WxlX8sh+li7pBNi2VYCT8NbHyf+AV8aO4V:vgzQ+D7ljXma/WxSTi7rT8xHY04V

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

ftpspooled.exe

pid process

1960 ftpspooled.exe
Loads dropped DLL 2 IoCs

Processes:

68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe

pid process

1988 68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe
1988 68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe

pid process

1988 68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe

pid	process
1960	ftpspooled.exe

pid	process
1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe
1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe

pid	process
1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe

description	pid	process	target process
PID 1988 wrote to memory of 1960	1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe	ftpspooled.exe
PID 1988 wrote to memory of 1960	1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe	ftpspooled.exe
PID 1988 wrote to memory of 1960	1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe	ftpspooled.exe
PID 1988 wrote to memory of 1960	1988	68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe	ftpspooled.exe

C:\Users\Admin\AppData\Local\Temp\68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68744e8157ff48fcc69df39ff7156e5a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\ftpspooled.exe
  "C:\Users\Admin\AppData\Local\Temp\ftpspooled.exe"
  2⤵
  - Executes dropped EXE
  PID:1960

C:\Users\Admin\AppData\Local\Temp\ftpspooled.exe

Filesize
224KB

MD5
68744e8157ff48fcc69df39ff7156e5a

SHA1
578fcb70a3e7eef21706aface343c6d5a8da5517

SHA256
32a3bbc3782c8baadbfa071d1b1eb8ad579ab4265fe0f122d545f19a7443e1a7

SHA512
d9d940bbf62c82c8dd818df42d8ebef43b2c263029bd2c0286dcf6173fdb0472a482017bdb044d66f147b9c0e0fb5186f29d46375464fa1246a54e9c853759f9

Download Submit
memory/1988-7-0x0000000000FE0000-0x000000000102A000-memory.dmp

Filesize
296KB

Download