b7f749147126ab0fb23e9fac46431b3ccb9e4cb3555315c8915a74a1438be066

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 00:12

Target

2a4bf0756246342f558048027679a97a_JaffaCakes118.exe
Size

222KB
MD5

2a4bf0756246342f558048027679a97a
SHA1

836da158e117311e6f0143bf1c7ff127d6890c90
SHA256

b7f749147126ab0fb23e9fac46431b3ccb9e4cb3555315c8915a74a1438be066
SHA512

fee4df91053602efacabcb911f2bbee3254bcd3e4a8c67a6e2db621bb039e1e455060895fffb0c18ecfde91b3976eca18fb87a58ebf5a1f199a0c6e63e6b786a
SSDEEP

6144:wwbJV0wQqcNRS/fejXRVuVyR1Xgdbun1TnD:wwbJKwQY/fe9VqkdD

Score

1^/10

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
324	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe
324	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 324	2884	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe	85
PID 2884 wrote to memory of 324	2884	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe	85
PID 2884 wrote to memory of 324	2884	2a4bf0756246342f558048027679a97a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2a4bf0756246342f558048027679a97a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a4bf0756246342f558048027679a97a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\2a4bf0756246342f558048027679a97a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2a4bf0756246342f558048027679a97a_JaffaCakes118.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:324

C:\Users\Admin\AppData\Local\Temp\~temp01281111290.tmp

Filesize
12B

MD5
65a5c6ab738b649228bdd10fbf1a988e

SHA1
4dff1b930213ba6f088097ea47591343c66ac7bb

SHA256
78d6cb49835d21428c646cce33a71c4ba9f864fba3d71d06f356166c8af545fc

SHA512
2fe42097f275dd2f9cd7407bae7a775eb6d559ca1fd7f87bd6dca1cb56c07556661ca30f9095337c252439b059f5a09d3e192485600618ec3c616776f2710287

Download Submit
memory/324-3-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/324-9-0x0000000000640000-0x0000000000696000-memory.dmp

Filesize
344KB

Download
memory/324-8-0x00000000006A0000-0x00000000007A0000-memory.dmp

Filesize
1024KB

Download
memory/324-11-0x0000000000640000-0x0000000000696000-memory.dmp

Filesize
344KB

Download
memory/324-12-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2884-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2884-5-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download