70c9be8601bf4749aecd3714e34672462f6f58ac0d7d50bd3ebf2ad54ff84fde

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 14:02

Target

49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe
Size

295KB
MD5

49fd4d3b48c420afa248f47e8fda1e81
SHA1

c12af6ed94b108ed81b0f66430447d1a2365b28b
SHA256

70c9be8601bf4749aecd3714e34672462f6f58ac0d7d50bd3ebf2ad54ff84fde
SHA512

f9409a209853f9cbbd50dc459d54e6ad113c4c89b405db4c9ebfab65a3f78e5b420cc2143579138495167d356daaa1258261867d1544b6eb689ce7f774832643
SSDEEP

6144:Q8loUdmPonSoAUagA4iw0qBRiAdraBCDoAc769/c:QUoUdUoiUaDZ/qnraByc769k

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31
PID 1480 wrote to memory of 3008	1480	49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\49fd4d3b48c420afa248f47e8fda1e81_JaffaCakes118.exe
  2⤵
  PID:3008

memory/1480-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1480-6-0x0000000003860000-0x0000000003912000-memory.dmp

Filesize
712KB

Download
memory/1480-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3008-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3008-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3008-7-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3008-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3008-13-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download