2534414d946ba415c13a9b2ee81493a648bebf9fd08b28a2616e32987b7aa8e4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 12:54

Target

1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe
Size

24KB
MD5

1a31394ca76edf9e560115187612b95e
SHA1

b163c33460e57ca1e854ac7b2f1e9df97e86960e
SHA256

2534414d946ba415c13a9b2ee81493a648bebf9fd08b28a2616e32987b7aa8e4
SHA512

7ad3a901af4ab540c059faf1caf059e1016dd1e0751165478d74c435c3d1853eb8384ac85669b714d683a33066c0eba02d87e128af29d0fc96d835baea9575db
SSDEEP

768:EU4hejVuz8EzpU5CWBxsqNpmWMtOEyOW131:EU48INg6tPyf131

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\skbskg.dll	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mjenpp.dll	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2912	2000	1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a31394ca76edf9e560115187612b95e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:2912

memory/2000-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2000-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2000-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2912-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2912-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2912-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2912-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2912-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download