6a8d7f8020d336021170ef09a8379008f7fa51490fda1cb754fdbc108701c123

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:46

Target

368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe
Size

31KB
MD5

368504fed3084397dad9fd5a27417b70
SHA1

a263f2aac1c430164d28cdc51310ba5aa5edc788
SHA256

6a8d7f8020d336021170ef09a8379008f7fa51490fda1cb754fdbc108701c123
SHA512

bec60acb11a7e36e365a9fc6d8bec55cbdfb3430c0f320cac14043b0690e6102871589dd5eee01c9dee7aa47e77624c2fe853c248111ded417bcb3757a2299e2
SSDEEP

384:/TwdDqmPyNDmngaRkwe9Uu7VxWiIY58o/ZuGcGh:/EdeT9ma99pHWpi/Zb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1444	rst.exe

Loads dropped DLL 2 IoCs

pid	Process
1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe
1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rst.exe	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1444	1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1444	1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1444	1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1444	1668	368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rst.exe
  C:\Windows\system32\rst.exe
  2⤵
  - Executes dropped EXE
  PID:1444

C:\Windows\SysWOW64\rst.exe

Filesize
7KB

MD5
15ddc23ecdc7d660211516e429ec5e18

SHA1
8af01edd8297fd67e6b032bacef93db4c6992322

SHA256
9032b59fdee35c4aeb4ff6e4ab1a6d927b36313c7aa909689b7c747f1d2fbf5f

SHA512
a82f4bb01f49e1cbc58c3f858a4adbc6d9968b2dc7811e2ff4d3011cb93d783929cff25f951815849650ffd2d7a278575f85b4da89aeaf0fadd00eec26ebdfb6

Download Submit