ce002c89a4d8eaa13cdedcaf11576548b7ceaa10fa1d3b77308f60bc69755ea7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 14:08

Target

1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe
Size

71KB
MD5

1647d85764d17c670cb10733a0886a26
SHA1

4de73bea5dfa5fe72e021499a74255d511d8e32e
SHA256

ce002c89a4d8eaa13cdedcaf11576548b7ceaa10fa1d3b77308f60bc69755ea7
SHA512

4b94f2322d69586771eccbeaf6995139656a2cd660ac13f4bfb9db1c4b0675ed092fc7a0834909ed6eda9d14c92775d24fb2c29ab57d7b3131a07be5e9fbe5e8
SSDEEP

1536:xPs7w3ffn/8SzjObxRWwjH3p2lZ6eZYB33COzguejkT:T3fX8/bxbj0hw3CkYjkT

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kr_done1	1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2124	1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2700	2124	1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe	28
PID 2124 wrote to memory of 2700	2124	1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe	28
PID 2124 wrote to memory of 2700	2124	1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe	28
PID 2124 wrote to memory of 2700	2124	1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninstf761c09.bat" "C:\Users\Admin\AppData\Local\Temp\1647d85764d17c670cb10733a0886a26_JaffaCakes118.exe""
  2⤵
  - Deletes itself
  PID:2700

C:\Users\Admin\AppData\Local\Temp\uninstf761c09.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/2124-3-0x0000000000412000-0x0000000000416000-memory.dmp

Filesize
16KB

Download
memory/2124-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2124-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download