19702ec0192d6f24746c6cc28ea40c46b9b6d61e96f9ce76bd485a77216f97a8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 18:58

Target

25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
Size

24KB
MD5

25e3cf6295dd19f542ec4912d8254622
SHA1

37c45087ccd1d2dbac0235194df24c308a709f67
SHA256

19702ec0192d6f24746c6cc28ea40c46b9b6d61e96f9ce76bd485a77216f97a8
SHA512

97ae4110db55838c391c25f596985f45d254e26f399dfec8e31701d4956698b59d2f5e3ebe7c5f024cbd7de480cfc5da607cc35e102da4aca5a1f3421764882a
SSDEEP

384:Eg5ncq9UwyGuR8DRzDYHltUzQ3bzHPnRkdfALKdkwSY0q4Cmw7UM:EgFHQHtUzQXmfALKdgBiV7B

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\skbskg.dll	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mjenpp.dll	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2076	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2076	2940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2076

memory/2076-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2076-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2076-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2076-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2076-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2940-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2940-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2940-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download