1cede1cb3b854c3623f5cd20b60575355be7b885c58a6d7f5da14e61de0ca733

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 05:07

Target

3c15369e272190582280b987db030d5c_JaffaCakes118.exe
Size

66KB
MD5

3c15369e272190582280b987db030d5c
SHA1

7ce52289dda7ce04fa076d6d304237585b6eda05
SHA256

1cede1cb3b854c3623f5cd20b60575355be7b885c58a6d7f5da14e61de0ca733
SHA512

e3ed86527bf15ce4692208a1e0f7b601ce4125571d0e002eae78646aa002032125e5f8d7d5d319e03b90b065bda76e00e6c4e7b9427c4426611cea577fa9b83c
SSDEEP

1536:ibx6sLU7cZMX1hrPuihzun6mLksGRXrDWY4:iN6WUQZGhrPVCtU314

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\zgjhxthuuxb5.sys	3c15369e272190582280b987db030d5c_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2100	2548	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	30
PID 2548 wrote to memory of 2100	2548	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	30
PID 2548 wrote to memory of 2100	2548	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	30
PID 2548 wrote to memory of 2100	2548	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3c15369e272190582280b987db030d5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c15369e272190582280b987db030d5c_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\qhmkioyha.bat
  2⤵
  PID:2100

C:\Users\Admin\AppData\Local\Temp\qhmkioyha.bat

Filesize
257B

MD5
33c565ec0a1066fc24c97d688efd3faa

SHA1
89e3134997bbb34aaa972913da133ea3bf51e196

SHA256
e069f164973b9957bbed26fd9d89669cdccce3bc0d8bf5d9c2afde2c9c90b106

SHA512
89706d207f94716f7ef8bb93fa36d2b2ee236067fe15b014c5a58b6ca1c36f5fe7d2c07a39917c09ff3c77c63b7d0e4daf67bf939b25ae584da99bfa69b3eb48

Download Submit
memory/2548-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2548-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download