fa22a9c96959087fc203c29240bbd07900774b0001c0a03cee10677a4b234776

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 23:11

Target

011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
Size

582KB
MD5

011407db883d8a77efed2b31de7fef93
SHA1

38d567477a94828b9aaf677ffd4bda4d621b09b2
SHA256

fa22a9c96959087fc203c29240bbd07900774b0001c0a03cee10677a4b234776
SHA512

e6dbb5d73f1a4ed4ae019a341e4c78ce033f30b4411bb9fa795144b278135492b9e7e867aec573dd50263caa29affe193ea0e5059bd323855cbe9399ba414858
SSDEEP

12288:Cq+7yQWTWvutmsnsvd9tS7TAvu/B1s6tQ2n:J+7hWTVtmsnsF9tS7T751s6tzn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2188	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2892	RedGirl.bat

Loads dropped DLL 2 IoCs

pid	Process
1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RedGirl.bat	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RedGirl.bat	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tmp.bat	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
2892	RedGirl.bat
2892	RedGirl.bat

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2892	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	28
PID 1028 wrote to memory of 2892	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	28
PID 1028 wrote to memory of 2892	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	28
PID 1028 wrote to memory of 2892	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	28
PID 1028 wrote to memory of 2188	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	29
PID 1028 wrote to memory of 2188	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	29
PID 1028 wrote to memory of 2188	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	29
PID 1028 wrote to memory of 2188	1028	011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\011407db883d8a77efed2b31de7fef93_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\RedGirl.bat
  C:\Windows\System32\RedGirl.bat 1
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\tmp.bat
  2⤵
  - Deletes itself
  PID:2188

C:\Windows\SysWOW64\tmp.bat

Filesize
267B

MD5
856c43bc90432941db3e3cb155befbaa

SHA1
77f4f9e5f65a681d9176b331cf466be64a91edf7

SHA256
41da480a5702ac443503d1e30fc37cf8c93c87026b62c7c6706eed5389d10a27

SHA512
17195b8c7ad741267d19c5f5e534e95df0d9f0dcc6d354a85993a94d391f0ac8a459ff71fb403c9ecade12841223dad80441f814c9c1eac28ebf18f628298641

Download Submit
\Windows\SysWOW64\RedGirl.bat

Filesize
582KB

MD5
011407db883d8a77efed2b31de7fef93

SHA1
38d567477a94828b9aaf677ffd4bda4d621b09b2

SHA256
fa22a9c96959087fc203c29240bbd07900774b0001c0a03cee10677a4b234776

SHA512
e6dbb5d73f1a4ed4ae019a341e4c78ce033f30b4411bb9fa795144b278135492b9e7e867aec573dd50263caa29affe193ea0e5059bd323855cbe9399ba414858

Download Submit