a88e9f71888bde4e1544afb2f4d38a238b1423c4c5e0b21e99153d7a91de4a45

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 16:57

Target

1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
Size

96KB
MD5

1bc7c2dc43779cca98fe800f1e5de95e
SHA1

c9f62dd1ef13e0f8e88a882ae97c0737a962770a
SHA256

a88e9f71888bde4e1544afb2f4d38a238b1423c4c5e0b21e99153d7a91de4a45
SHA512

7394a1c5fe8f56f695e634d99c5e4c339d15af4a48e4fb35bb9f6539f3ce298dd3a63f74cfeba9fbdc23095fec3f02e0c221a5c4fb354e05e0b42c268f11e305
SSDEEP

768:LYAdknRMDcDmRG6uB3T7uGJK/sYAdknZOfdlGcQ6mOyFDd+jC7mVBe7/:Eh6oP6KD7uJhZOXQyydd+27MBq

Score

7^/10

Deletes itself 1 IoCs

pid	Process
988	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gdqqhxi32.cfg	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gdqqhxi32.dll	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gdqqhxi32.dll	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 64 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 988	2368	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe	28
PID 2368 wrote to memory of 988	2368	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe	28
PID 2368 wrote to memory of 988	2368	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe	28
PID 2368 wrote to memory of 988	2368	1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:988

C:\Users\Admin\AppData\Local\Temp\tmpD5E.tmp

Filesize
3KB

MD5
99f0ef41b2a4c61f9d0ef8775864a685

SHA1
7067b16ff21b957b645a030f466c38e3af568a7e

SHA256
cb83cd82e60d8adf0d740d7bc9735a71581ce0a0bcda2d2fd159ce9e52590bf2

SHA512
b2ca322d83bc27acb8b00f2a84f228c6a9b52a9f672560519eb849ce19b765ac12762314af9c750a1487a0e8a4652693b3842bbab4e9e06740967f6ba052e9c4

Download Submit
C:\name.log

Filesize
58B

MD5
5602febf87bd4c535da2d4e90f56e52b

SHA1
e563ac3a277e614480525dc60061a06afe1a0419

SHA256
569f5ce34e8e491d1b425b57cc90c1463d72eb531983727557802b17c148486b

SHA512
b0e8186706e004b800f3e554171c2a3d8c7391b5d0ba8694380fdfdd12fb09330033a1af29bdc8898a09fabad611aaa98e3deb51d2e4d6e1e0d524b673eddb0f

Download Submit
\Windows\SysWOW64\gdqqhxi32.dll

Filesize
12KB

MD5
1a2de1b80c6391612ee10b7a9941258c

SHA1
2bc252895427cee52921ad8399bf8471c5bdeba1

SHA256
c368c5534e32f74f281462de4a8d73bdaef62293f77bb85ae4d0f85a60cf8c40

SHA512
d64f4bb99c326e0f6edfdc367b21e4976ab3ad17d046eeebab50f20f6c4245f565779169b945efadf6a12d077fddb5662ae097334d17367aa060b691c4e76ea4

Download Submit
memory/2368-3-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download
memory/2368-316-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download