29d435e6f500ebb2ed7441583af4eaad1e4c541513511164fc7e3f22b6080f3d

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 22:41

Target

00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
Size

267KB
MD5

00f0042c6bb29af663af169c5b56e12c
SHA1

04187fd62420673775e6d9c240c13ad3aedfefea
SHA256

29d435e6f500ebb2ed7441583af4eaad1e4c541513511164fc7e3f22b6080f3d
SHA512

26fcdd1230e571520d71edd4728df1a981101eb4cacd9843478670387b7d362b4b5e5c5835cbc6bb71cbb941b6a10283949322c189ce12e0c23d3e6a86c2ff35
SSDEEP

6144:WxvyW7ubPVWCW6Nwho2gJWR0bxL03OwAB/Pl:HWibPV5WLkLbxL03Od

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2108	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
320	G_Server1.23.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\G_Server1.23.exe	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
File opened for modification	C:\Windows\G_Server1.23.exe	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
File created	C:\Windows\Delete.baT	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	G_Server1.23.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
320	G_Server1.23.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2344	320	G_Server1.23.exe	29
PID 320 wrote to memory of 2344	320	G_Server1.23.exe	29
PID 320 wrote to memory of 2344	320	G_Server1.23.exe	29
PID 320 wrote to memory of 2344	320	G_Server1.23.exe	29
PID 1676 wrote to memory of 2108	1676	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2108	1676	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2108	1676	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2108	1676	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.baT
  2⤵
  - Deletes itself
  PID:2108

C:\Windows\G_Server1.23.exe
C:\Windows\G_Server1.23.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2344

C:\Windows\Delete.baT

Filesize
214B

MD5
ee2ac5eb8b8c3bb83e949ef6b0a1fa9c

SHA1
265110c6d3de72f4939c557f927ce04c270a66a1

SHA256
ccd5bec4733178e26714c94999ebb74ccd8c3a953106f11c724f07375c289798

SHA512
8f304990528ff81855392b05085c4c23fba05a2263dd6dea0c5d9b2a82c66622ecd810843b76645c1b294f59d1771c7c101588f4506d1bafa97157052b1fe718

Download Submit
C:\Windows\G_Server1.23.exe

Filesize
267KB

MD5
00f0042c6bb29af663af169c5b56e12c

SHA1
04187fd62420673775e6d9c240c13ad3aedfefea

SHA256
29d435e6f500ebb2ed7441583af4eaad1e4c541513511164fc7e3f22b6080f3d

SHA512
26fcdd1230e571520d71edd4728df1a981101eb4cacd9843478670387b7d362b4b5e5c5835cbc6bb71cbb941b6a10283949322c189ce12e0c23d3e6a86c2ff35

Download Submit
memory/320-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/320-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1676-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download