2ae7e7e8590bb14ec12fff4315c60c8a3993b18865a4c7557553921b020fb0fe

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 12:46

Target

45df69236b53f72bb500f003015b2012_JaffaCakes118.exe
Size

289KB
MD5

45df69236b53f72bb500f003015b2012
SHA1

aad5735af15034ee218537b0818375a762dada83
SHA256

2ae7e7e8590bb14ec12fff4315c60c8a3993b18865a4c7557553921b020fb0fe
SHA512

310ed9fe40e3e55855ef0d6371cb1fc4f74a46d4b6bf19a7eebac65aad05fc4f0689e567061d355886fadbcc7ada32a879fe4bda63a6841a3e302e84a3071a62
SSDEEP

6144:tMsY9oyutiLNgS9m0BxEhXpd9nTk+ntt7xo5R3ujohr4WjEjo4V:tjAuixggK3ntBxofbVM

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3040	5DBA.tmp

Loads dropped DLL 3 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3040	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3040	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3040	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3040	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2908	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	31
PID 2268 wrote to memory of 2908	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	31
PID 2268 wrote to memory of 2908	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	31
PID 2268 wrote to memory of 2908	2268	45df69236b53f72bb500f003015b2012_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\45df69236b53f72bb500f003015b2012_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45df69236b53f72bb500f003015b2012_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\5DBA.tmp
  C:\Users\Admin\AppData\Local\Temp\5DBA.tmp
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\45df69236b53f72bb500f003015b2012_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\45df69236b53f72bb500f003015b2012_JaffaCakes118.exe" --cp "C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"
  2⤵
  PID:2908

C:\Users\Admin\AppData\Local\Temp\5DBA.tmp

Filesize
242KB

MD5
b8e79715f306b0b7b565c1e9dc04ef8a

SHA1
a1ae0556e45fa556ad733799d4eede9d9d4397e4

SHA256
abfa8858b135e345050e269e10a5d8e620ffc8e43373114847ed1938f4c469df

SHA512
7a33eae2b5f61a256e281d55c61dfa28b1a7b74de62540d0fd1d5ca8a808a44039ef4e97f1a4634af2aeffc4d508eb824a39bffde4f6dfa881f1449af8f42739

Download Submit
\Users\Admin\AppData\Local\Temp\5DDA.tmp

Filesize
289KB

MD5
49c6b5bb019ba55d2dc919669fac730e

SHA1
a952e85d496a5ee4e81c05c4f996c741e47ed0c0

SHA256
358e4835f46d0c033bd450ce80798786007548499d9fb793c4cb1d303c671bc3

SHA512
352ac63511a1831fefe40a906f4d171a25f03aa3283af107117d101fda47deb1422a2d63d6a0badb8fdbbf18bace5515d3c9d372c4417902a527bec2f3bd6c27

Download Submit
memory/2268-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2268-8-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2908-21-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3040-13-0x0000000000400000-0x000000000043E098-memory.dmp

Filesize
248KB

Download