6fdd9f8829a43f87a297256a6011388218b08b8e578cf1cd63dd5538a0a3b456

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 18:13

Target

1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe
Size

52KB
MD5

1c025b2ec518bbee9ba6ce9e975478b6
SHA1

8917b2f23641cd45d2a4aea6c5c53e14cf6e5e87
SHA256

6fdd9f8829a43f87a297256a6011388218b08b8e578cf1cd63dd5538a0a3b456
SHA512

91f55336415c311c475910d5cc2fa61f27e64f8734a175b14c98f9a382a87374dd3542419604b19e8d5f75cfd910bdf4923b194d56ebeb81acacd474bd81a514
SSDEEP

1536:OrgZ3TSfRbDqkFUgiNNco5mmLRLYzKbC:2jfRbWkFVc5m22zKbC

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2684	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	tapgbwxw.exe

Loads dropped DLL 2 IoCs

pid	Process
1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe
1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2432	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	31
PID 1872 wrote to memory of 2432	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	31
PID 1872 wrote to memory of 2432	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	31
PID 1872 wrote to memory of 2432	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	31
PID 1872 wrote to memory of 2684	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	32
PID 1872 wrote to memory of 2684	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	32
PID 1872 wrote to memory of 2684	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	32
PID 1872 wrote to memory of 2684	1872	1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c025b2ec518bbee9ba6ce9e975478b6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1872
- C:\ProgramData\tkpmhmpc\tapgbwxw.exe
  C:\ProgramData\tkpmhmpc\tapgbwxw.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\1C025B~1.EXE.bak >> NUL
  2⤵
  - Deletes itself
  PID:2684

\ProgramData\tkpmhmpc\tapgbwxw.exe

Filesize
52KB

MD5
1c025b2ec518bbee9ba6ce9e975478b6

SHA1
8917b2f23641cd45d2a4aea6c5c53e14cf6e5e87

SHA256
6fdd9f8829a43f87a297256a6011388218b08b8e578cf1cd63dd5538a0a3b456

SHA512
91f55336415c311c475910d5cc2fa61f27e64f8734a175b14c98f9a382a87374dd3542419604b19e8d5f75cfd910bdf4923b194d56ebeb81acacd474bd81a514

Download Submit
memory/1872-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download