5366de995770690760cfa48072346c57cac2476e0c2f767d52084d1731a57c58

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 06:15

Target

038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe
Size

337KB
MD5

038d462fd5e92f0e3280695869b5bc19
SHA1

8c085be2e38b0f6b445aeb9415fc5f5964aa5d21
SHA256

5366de995770690760cfa48072346c57cac2476e0c2f767d52084d1731a57c58
SHA512

0417ebacbe2af060f80fa98bf17d6ec53511ebff8caa65ec7397d752dd7adf5ce14c26db0d23be2c92cd5428a5e0be1af8226edb5f6d1fa81f66491aa5bc7adf
SSDEEP

6144:Q6Edl48TBqvuH/nspX7wRI9E+k84pxy9t6lYK9u3hhpIUJ7g:QHdl48TQvufspL4Z+2A9t6l3U3DpIG7g

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1940	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1928	wscsvi.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe
2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wscsvi.exe	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wscsvi.exe	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tmp.bat	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1928	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1928	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1928	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1928	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1940	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	29
PID 2232 wrote to memory of 1940	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	29
PID 2232 wrote to memory of 1940	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	29
PID 2232 wrote to memory of 1940	2232	038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\038d462fd5e92f0e3280695869b5bc19_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\wscsvi.exe
  C:\Windows\system32\wscsvi.exe 1
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\tmp.bat
  2⤵
  - Deletes itself
  PID:1940

C:\Windows\SysWOW64\tmp.bat

Filesize
267B

MD5
5bffc1b44f690ccd511865237137c08e

SHA1
6f2bbc70fc451ee96be5209348f0fba4481aee1c

SHA256
05438555a01c89a811da630e4a1b7fc8015e2c51ff2c3f05806575322215474c

SHA512
f2a0ec387396b9e9e05b8cdd1b9f03959b623da12e884aaac906fc8a1ec8b638cc60e5a20b23e26951048e4b875dbf6528f9bc472277c0179a8efcb3f45a984c

Download Submit
\Windows\SysWOW64\wscsvi.exe

Filesize
337KB

MD5
038d462fd5e92f0e3280695869b5bc19

SHA1
8c085be2e38b0f6b445aeb9415fc5f5964aa5d21

SHA256
5366de995770690760cfa48072346c57cac2476e0c2f767d52084d1731a57c58

SHA512
0417ebacbe2af060f80fa98bf17d6ec53511ebff8caa65ec7397d752dd7adf5ce14c26db0d23be2c92cd5428a5e0be1af8226edb5f6d1fa81f66491aa5bc7adf

Download Submit