c1d526e5fb30ef81d755c3c99fe8a6fed3c0a969c52d25a1d799bd6440cf5541

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 05:17

Target

03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe
Size

20KB
MD5

03213606b154cdf27ef999b3f0be54ae
SHA1

df28364d1ec8a9e314c0a7a29eec33692f397f82
SHA256

c1d526e5fb30ef81d755c3c99fe8a6fed3c0a969c52d25a1d799bd6440cf5541
SHA512

f469dfd766d909c32a257b75ea934c8314955cce12705f26e7709dea048c9443dc745d03a1aeb6a552fab32c9995cf94b182fd9f3c3fa0a8e0c00a0373447772
SSDEEP

384:IXwWtsW4cCoAkQMr7Pd5QlS8J5U3255Tiv0D1GCBTlHpfxPjK:CyoHQMnVqlVHUG55TicD1GCnHpfE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
856	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\imgvew.com	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\imgvew.com	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2348	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	28
PID 2172 wrote to memory of 856	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	29
PID 2172 wrote to memory of 856	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	29
PID 2172 wrote to memory of 856	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	29
PID 2172 wrote to memory of 856	2172	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:856

memory/2172-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2172-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2348-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2348-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2348-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download