007d35085f290ec5963ba8f83e25d655a73474b738575feea58937a36cddab07

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 20:15

Target

0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe
Size

31KB
MD5

0aa32a2e9f84ed0e99ad20b10cf59652
SHA1

400a4fb375c09afed162fa3c9b23adc23b41d608
SHA256

007d35085f290ec5963ba8f83e25d655a73474b738575feea58937a36cddab07
SHA512

f0dc3c5cb7e591bbfe9e7665501c386bb0bb91ae8288a2388d2386e6e42182d954d338fea73dad726c3bef3d64dc9463c58878be5db9546724fda20038100530
SSDEEP

384:wYEMGyXFfuhLpGN64bA6kc2/5hSxzxPpa+LxgDdeElSUak/Iw3NCgPR3:n/vXFfuhNy6s50/ip3diYUakXcs

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3008	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	28
PID 2036 wrote to memory of 3008	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	28
PID 2036 wrote to memory of 3008	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	28
PID 2036 wrote to memory of 3008	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	28
PID 2036 wrote to memory of 1944	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1944	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1944	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1944	2036	0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\0aa32a2e9f84ed0e99ad20b10cf59652_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\Temp\file.rst"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:1944

C:\Users\Admin\AppData\Local\Temp\file.rst

Filesize
31KB

MD5
0aa32a2e9f84ed0e99ad20b10cf59652

SHA1
400a4fb375c09afed162fa3c9b23adc23b41d608

SHA256
007d35085f290ec5963ba8f83e25d655a73474b738575feea58937a36cddab07

SHA512
f0dc3c5cb7e591bbfe9e7665501c386bb0bb91ae8288a2388d2386e6e42182d954d338fea73dad726c3bef3d64dc9463c58878be5db9546724fda20038100530

Download Submit