40db083209581596f4da74f4ee827870a6fca66441251ea6a2ef0d397b519699

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 00:03

Target

59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe
Size

31KB
MD5

59a705087c4ac5f8d337e93353870308
SHA1

e0052c7b432ee3a0f8624a57b48064910ca3ff74
SHA256

40db083209581596f4da74f4ee827870a6fca66441251ea6a2ef0d397b519699
SHA512

5e4f652f4c6323f6de2fdb97d8de1f152e92c3c206d8636665b5d08e189c23c0be94c8d208a9fa7d8b9c687e70a662d4f3103843f3409e8cc2e558b4fa283338
SSDEEP

768:btU5nx4PprompROnPdC+Ych9v4eyzsKq/iz:btgGroPdCELgLYKq/A

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1736	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2928	Kerne121.exe

Loads dropped DLL 2 IoCs

pid	Process
2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe
2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kerne121.exe	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Kerne121.exe	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Kerne121.exe	Kerne121.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2928	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2928	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2928	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2928	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	30
PID 2772 wrote to memory of 1736	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	31
PID 2772 wrote to memory of 1736	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	31
PID 2772 wrote to memory of 1736	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	31
PID 2772 wrote to memory of 1736	2772	59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59a705087c4ac5f8d337e93353870308_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\Kerne121.exe
  C:\Windows\system32\Kerne121.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$a$$.bat
  2⤵
  - Deletes itself
  PID:1736

C:\Users\Admin\AppData\Local\Temp\$$a$$.bat

Filesize
152B

MD5
8fac0462915ccdd4e433719f3669c06c

SHA1
7b97d8f0eb45beaf9e913b9da4461d1ac3805fbd

SHA256
02ab0908d3f25906d20851ab5161cfee7518df6fd7890e5f72bf387bdb72cbc4

SHA512
4d798f65d0b60f21555af1fc5e4189f580eb403ea9fa47af44460472c6b885d1d49de14c49ff0aad9e4991a36fa877ed6f2ee9ec868352c9c0817998b1a499c8

Download Submit
\Windows\SysWOW64\Kerne121.exe

Filesize
31KB

MD5
59a705087c4ac5f8d337e93353870308

SHA1
e0052c7b432ee3a0f8624a57b48064910ca3ff74

SHA256
40db083209581596f4da74f4ee827870a6fca66441251ea6a2ef0d397b519699

SHA512
5e4f652f4c6323f6de2fdb97d8de1f152e92c3c206d8636665b5d08e189c23c0be94c8d208a9fa7d8b9c687e70a662d4f3103843f3409e8cc2e558b4fa283338

Download Submit
memory/2772-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2772-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2772-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2772-12-0x00000000003B0000-0x00000000003CD000-memory.dmp

Filesize
116KB

Download
memory/2772-24-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2928-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2928-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2928-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download