e39f2cf7436f322e7f1f2e6f5a863c52963108c992792bc0d8aee21b2f9a1724

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:18

Target
923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
Size 6.5MB
Sample240603-spms2aaf3z
SHA256 e39f2cf7436f322e7f1f2e6f5a863c52963108c992792bc0d8aee21b2f9a1724
MD5 923db4042ce9dbe698c65fa0c5b36cbf
SHA1 f99709db62550686b2ebba9baa5b445dd6b7a4e2
SHA512 5dc2ec39278dfa5ed99fce6b3eb635493398660ee9eadaed185f9070ba382c427f0d8f1e399641e48dc6ee4f770439630c67b1ff3bcb51074d81a0b641121808
SSDEEP 98304:m+PBf6xbJ6q0b335KjCuuGbTX5SbWf+YFCnUGWfQpU8nZTcEzVFy6t:bQcJDbPGvXQaf+HAfqUbWy6t
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1336	SeoSystem.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1336	2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe	83
PID 2408 wrote to memory of 1336	2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe	83
PID 2408 wrote to memory of 1336	2408	923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\923db4042ce9dbe698c65fa0c5b36cbf_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\SeoSystem.exe
  C:\Users\Admin\AppData\Local\Temp\SeoSystem.exe
  2⤵
  - Executes dropped EXE
  PID:1336

SeoSystem.exe

Path C:\Users\Admin\AppData\Local\Temp\SeoSystem.exe
Size 2.5MB
SHA256 3b27bc8207f826cf4ef8208697e5d4d3553b7c0877ffd892df9371bade33fe92
MD5 9ccd99b989f3c1dfa5bebc35f815f696
SHA1 575c779261f04f320be2291d1202d9ea6d49739b
SHA512 2d5a0424291adfafd83858ed3c0525d77321e316173c06269cecacf3287aaacc730c4928d50144e138d92e317fa4f9cd9e0c43cdbe7384d780d2244f37b0addf
SSDEEP 49152:WWCsVb6KUpZ+hDg1F2d6o4oAfWnWInAzdqpzYUWe8IVtUzkV:W5SbWf+YFCnUGWfQpU8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-7-0x0000000000400000-0x000000000068F000-memory.dmp

Download

memory/1336-8-0x0000000000400000-0x000000000068F000-memory.dmp

Download