0c31b95befcd06e29f74d1682f87477a9f189b3f725eb86c2f86ad53c0bd5097

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:51

Target

089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe
Size

423KB
MD5

089c1a119d9c658b310a3a44d59b4091
SHA1

e5cfa7773b74735634271e8399709faabeefcc32
SHA256

0c31b95befcd06e29f74d1682f87477a9f189b3f725eb86c2f86ad53c0bd5097
SHA512

bc229c8025693c2eeb8b69eb54c00c80abafe7e3b10e12ce9653229cd63b5034fe821c3342a854a4dec703e0a622f98d170617a5546093051ca85a9a33835569
SSDEEP

6144:WABt57v4rn+40fNfL7M5Q7LjgWj713KucT5SI+Y5H9BiY7WwgvKQXB8Lm:WET7enAVM5Yjg8Bf+Z5H9QY6vKQRH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2384	ijpvcqgf.exe

Loads dropped DLL 1 IoCs

pid	Process
1752	089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rqaosaob\ijpvcqgf.exe	089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2384	1752	089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe	28
PID 1752 wrote to memory of 2384	1752	089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe	28
PID 1752 wrote to memory of 2384	1752	089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe	28
PID 1752 wrote to memory of 2384	1752	089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\089c1a119d9c658b310a3a44d59b4091_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\rqaosaob\ijpvcqgf.exe
  "C:\Program Files (x86)\rqaosaob\ijpvcqgf.exe"
  2⤵
  - Executes dropped EXE
  PID:2384

\Program Files (x86)\rqaosaob\ijpvcqgf.exe

Filesize
435KB

MD5
2598c20dfb8d06bfa13b15fceb9aca4f

SHA1
6ea41eb5059f1c344d5f09c516b4cfae65925321

SHA256
3ac743d663ce465d21befc8c0e3632387adaee3ff70d24abe8bb6a71c11107b3

SHA512
f4e84b5b9f3db586cbb67507c0733a6ccd0318bd57ff341760bc492a2f15db4c84528d489bedcbd3576165dc3e4b39f1153fa6202db8b08a0a19c36020f57800

Download Submit
memory/1752-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1752-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1752-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2384-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2384-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2384-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download