a733c9cfe176b805fea154c70a6a3be22efbcb25a07948cc0b15e459cd95fe04

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 05:51

Target

1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe
Size

96KB
MD5

1904b354c79d83b334e6baaf20b3ebbe
SHA1

ec7829d39c0d14e2f8bbdf0487367f5e50798a89
SHA256

a733c9cfe176b805fea154c70a6a3be22efbcb25a07948cc0b15e459cd95fe04
SHA512

825b7022c73e84c1bd88a42b77f8a38a8ac7ed9bcae41dd5765586bf553a7a091b5b06999575929277895e9f623ec6750dd550580e15299c5d2f1a70505750f4
SSDEEP

3072:OI/WgHrj8fHzf0P/HR3d3QCV8f+pZvRDH:O4Lj8vz8RKC6+zvZH

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vmmreg32.dll	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2864	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe
2864	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2864	1988	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	28
PID 2864 wrote to memory of 1260	2864	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	21
PID 2864 wrote to memory of 1260	2864	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	21
PID 2864 wrote to memory of 1260	2864	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	21
PID 2864 wrote to memory of 1260	2864	1904b354c79d83b334e6baaf20b3ebbe_JaffaCakes118.exe	21

memory/1260-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1260-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1988-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1988-10-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2864-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-7-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download