7eab61dcb8a846711b171f33ae507e8546f84c16e626520b17260bdfd5f042e1

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 18:26

Target

1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
Size

2.4MB
MD5

1c0ba2f64e0e3787adf106f27f7b728c
SHA1

f37a7824899d432330f2bf214e96fa48b9fdce31
SHA256

7eab61dcb8a846711b171f33ae507e8546f84c16e626520b17260bdfd5f042e1
SHA512

1a98cb23e211376f3cf9b72a2e3bb32d5c996ce695e2b7e5ade7b0f12f8ee109e53804e13aeb6e96a1fc177dddb48e256faa89d592fd708663d6e3bd3db9a462
SSDEEP

49152:dqgazxcGYN139lnk30ray05H8/cI83YeEgytVle:dqgazxc5H39ln2Ny0WmYdJt/e

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1396	djlek.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\hkd\djlek.exe	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1396	2972	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	28
PID 2972 wrote to memory of 1396	2972	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	28
PID 2972 wrote to memory of 1396	2972	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	28
PID 2972 wrote to memory of 1396	2972	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\hkd\djlek.exe
  "C:\Program Files (x86)\hkd\djlek.exe"
  2⤵
  - Executes dropped EXE
  PID:1396

\Program Files (x86)\hkd\djlek.exe

Filesize
2.4MB

MD5
6f3ecc6455d9e47971d3f21affb181ee

SHA1
e50ecae5a849e3e45483535b54a839d11b9b11bc

SHA256
e3fbe26106c942e16c5bc8bc5385316e5175aa6d86fbe25da11c1d76fbbada11

SHA512
9055ad726e1c070a3ce8b3a0950a188bd424b427d743342ca665921c731fd4bf92fd6405fbbff0960f942e253923566191b14b4837f88e0d39c51781393b186c

Download Submit
memory/1396-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2972-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download