44d86d4b80907a8276a728007d3843d0e27656c43b79f90f8345fc204cff5d7d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 18:35

Target

42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe
Size

112KB
MD5

42dcc41d7f098725e9a3162382463271
SHA1

e1c8aed060cb13a1ef60b6ab94d084798d93e2eb
SHA256

44d86d4b80907a8276a728007d3843d0e27656c43b79f90f8345fc204cff5d7d
SHA512

c9e53e9c8b90375cd2932f049b15d8a2a170e8b20196cdb6ccf79218dfd6e9e359f20f4355fea30981fe562e4ec45b2f27b269aec76617efe5733c5e2651fd11
SSDEEP

1536:nlx7R1Mez/Waxc6D3nnxv1yZTG8BBEtq+g6Bd:PPMU/BhD37yFGVqh

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\skbskg.dll	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mjenpp.dll	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1096	2292	42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42dcc41d7f098725e9a3162382463271_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:1096

memory/1096-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1096-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1096-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1096-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2292-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2292-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download