879d42c230e66102e8547c525266ad497f466c3f03afade943e02f36190bc6a8

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 14:13

Target

0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe
Size

8KB
MD5

0e5fbecf78829f718e0e74b3b85eeb5d
SHA1

e628496d35a147331639ec4a625db59059f26f42
SHA256

879d42c230e66102e8547c525266ad497f466c3f03afade943e02f36190bc6a8
SHA512

ba0b77916af9e5376725f6f90823cb5b3df8cbfdbbb1f1fcc84b2c3af07ee8ee40c136bb09b53bceb0da821ab6d41af1312fca90ebace35e317c9fe55654b31f
SSDEEP

96:pdk491Sp4hJVyV7nS62sQC4o4fOYyTSzm9izZp43Z9Ngp:DR964bVyV7SM4o4feeEEZpaHQ

Score

1^/10

Runs .reg file with regedit 1 IoCs

pid	Process
3068	regedit.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2724	2200	0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2724	2200	0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2724	2200	0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2724	2200	0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe	29
PID 2724 wrote to memory of 3068	2724	cmd.exe	30
PID 2724 wrote to memory of 3068	2724	cmd.exe	30
PID 2724 wrote to memory of 3068	2724	cmd.exe	30
PID 2724 wrote to memory of 3068	2724	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e5fbecf78829f718e0e74b3b85eeb5d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\259419928.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\regedit.exe
    regedit -s C:\Windows\FONTS\fonts.reg
    3⤵
    - Runs .reg file with regedit
    PID:3068

C:\Users\Admin\AppData\Local\Temp\259419928.bat

Filesize
113B

MD5
4346502d5635a6444fb1ec640d1a2c64

SHA1
2d43d8f4ecd18ce9bb0ff1c6878a41c0e3cd4d67

SHA256
ace5a4b522bfe9dd1b0b84a7639f9e60d2419fc97f08df1b9ec9bf8eb0a42fcd

SHA512
0b6e90dae24ee9e8092345857db5daa2136bd0548ea7197618063945228e889aa9aac9af46fcd5d9d63e889b27040b42b9b9ed7c2df7e531a6634560585463bd

Download Submit
memory/2200-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2200-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download