ef3a218af00c8e9e0aac4663a0ad6a44d7acab9baa09dd996319e2c828a27900

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 02:47

Target

0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe
Size

126KB
MD5

0c21ad24e06cc5efc86eb7aea00c2604
SHA1

6a4e915f322f44c28eaa937ef7c96c2571a4e888
SHA256

ef3a218af00c8e9e0aac4663a0ad6a44d7acab9baa09dd996319e2c828a27900
SHA512

4f3e8701d910cec05876a06a5f8b81db960afa50df504f44496ffd477f872376cd1a75bffb586a20fda2df02a406a36d5be0fc01829ad60040262d02c947f1c0
SSDEEP

3072:T0lE4ct5xMIRPpmFkyrW9c8yjcdK0oGU7TQwPzrc77OWw8x8cJ:gOrt5xMaPp+kyrWCKIG4fc769/c

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1540	2208	0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0c21ad24e06cc5efc86eb7aea00c2604_JaffaCakes118.exe
  2⤵
  PID:1540

memory/1540-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2208-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download