c7f6b2dbcd089c8c8eae6d5798cdf57135f1013e22cb325545ed3d5c4e6858a6

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:25

Target

05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
Size

661KB
MD5

05846ef0771d1b925a8d526b8af0d8b7
SHA1

c7d54df3c5f26869ce9f15e118d1e703ad9fc85f
SHA256

c7f6b2dbcd089c8c8eae6d5798cdf57135f1013e22cb325545ed3d5c4e6858a6
SHA512

d1bcc99bbf9a42c4c8784f8fbe08e9e488b8bdfb13da7d6b2f63674c1d49b784e7a8e8343e04fcf5adf26ee2113b72c097e550ae9337111264ed1ccf17003438
SSDEEP

12288:Tk+vceJ2HfgG+26geCaZnZfeZ1g+3dNvfsS1aCcIJjWowMH3hq2QtinT9:Dvzeg7RWaNZS/37mCcINWozxL

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wc98pp.dll	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ = "C:\\Windows\\wc98pp.dll"	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ThreadingModel = "Apartment"	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\CLSID = "{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}"	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1348	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe
1348	05846ef0771d1b925a8d526b8af0d8b7_JaffaCakes118.exe

memory/1348-0-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1348-1-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1348-3-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1348-5-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download