9bddc4ff3c761d69ed89a84e9dc3f030dde89a1e3ae0ddb0acf462221a471c17

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 15:56

Target

2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
Size

77KB
MD5

2cee99afe64a27497625531e8002011d
SHA1

9c9164ab4d87c1ad72ca4e4421df3bf87a01c250
SHA256

9bddc4ff3c761d69ed89a84e9dc3f030dde89a1e3ae0ddb0acf462221a471c17
SHA512

be9726166743a4d6e64cb0198d54df634127059874f6ec285d355d0f4183b61b6870621f5002f871e61b077e8a62fcab3ea342b316c2d696fe89f44782628bb4
SSDEEP

768:giSqdQOJUDkXoOg8qaSJOUQ9v4G9CBXSQmiLdcw1AEZz0rZmJsjm/lg/16AS:nSqdQOJTYOXqPQ9v4JRLbWGzQxUgto

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2164	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2768	NTdhcp.exe

Loads dropped DLL 2 IoCs

pid	Process
2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NTdhcp.exe	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NTdhcp.exe	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NTdhcp.exe	NTdhcp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Deleteme.bat	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2768	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2768	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2768	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2768	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2164	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2164	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2164	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2164	2672	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cee99afe64a27497625531e8002011d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\NTdhcp.exe
  C:\Windows\system32\NTdhcp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Deleteme.bat
  2⤵
  - Deletes itself
  PID:2164

C:\Windows\Deleteme.bat

Filesize
212B

MD5
185e979243e1c67bbdebd7b453ab3ac6

SHA1
2492065831a174fbc13d79ea502cdb45b73964af

SHA256
80969538533203d341448df6b6ca873b9bac2548a80a2660732891891fa7177b

SHA512
de4117bb3be6646d736ca61232fd4e301e7928923657d00d2bb4b508f8d9ae8eafb939b658eb7f54d46723809ff27a7096a60575ef9bbd4cbddad11eb760c1f2

Download Submit
\Windows\SysWOW64\NTdhcp.exe

Filesize
77KB

MD5
2cee99afe64a27497625531e8002011d

SHA1
9c9164ab4d87c1ad72ca4e4421df3bf87a01c250

SHA256
9bddc4ff3c761d69ed89a84e9dc3f030dde89a1e3ae0ddb0acf462221a471c17

SHA512
be9726166743a4d6e64cb0198d54df634127059874f6ec285d355d0f4183b61b6870621f5002f871e61b077e8a62fcab3ea342b316c2d696fe89f44782628bb4

Download Submit
memory/2672-0-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/2672-10-0x0000000000220000-0x0000000000237000-memory.dmp

Filesize
92KB

Download
memory/2672-11-0x0000000000220000-0x0000000000237000-memory.dmp

Filesize
92KB

Download
memory/2672-22-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/2768-12-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/2768-20-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download