8eb2a376ab5ff63812ff684e4d4ad87a301f4ff84cd3e8cc3d027ea8ca0c309e

Analysis

max time kernel
141s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 14:47

Target

4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe
Size

110KB
MD5

4647bc3cb996ddc6daee76665b4ba2d6
SHA1

0e73f53e23f47e6b4bb6f37869b4f5a448758859
SHA256

8eb2a376ab5ff63812ff684e4d4ad87a301f4ff84cd3e8cc3d027ea8ca0c309e
SHA512

9cb4db872efdbb194f0319858c45ca38562e2142ee4d73a92eae7028efaf64799e26ecf82d64430f518a6e3fac87541b36093db6311c6201ca08e072d21ca28e
SSDEEP

1536:dTKdhmMFi+lokn0CcuQpuv0Ix0vkHWR8ceQDxeOg:dT8cUi20DuQpKnsMkrBg

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4452 set thread context of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84
PID 4452 wrote to memory of 3040	4452	4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4647bc3cb996ddc6daee76665b4ba2d6_JaffaCakes118.exe"
  2⤵
  PID:3040

memory/3040-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3040-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3040-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download