c8d55a743c529c7a2215e64f8b604e8a9b823329ef70372cdf90cfcd8c1d8c35

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 10:24

Target

62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe
Size

100KB
MD5

62da4f9656a3aedc50c0510dc6efe9c3
SHA1

2e645684d272917dbbf755cac596bab292610af1
SHA256

c8d55a743c529c7a2215e64f8b604e8a9b823329ef70372cdf90cfcd8c1d8c35
SHA512

213d21108028eedf2af20e0b843424546c3b8178ac2ed5aced78832f7e55f04b5515f8314752edf87b63735aec819fe0c4e28c33b131c9aee02bb4680ca18314
SSDEEP

768:XJSaao+vVVOFX/86/Vm/mrJSaaT6LkfwePAS/GGAruKDZC:XJSn/DsVnJSnT6L2wePrxD+

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2180	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
332	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xhqq.cfg	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xhqq.dll	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xhqq.dll	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
332	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2180	332	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe	31
PID 332 wrote to memory of 2180	332	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe	31
PID 332 wrote to memory of 2180	332	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe	31
PID 332 wrote to memory of 2180	332	62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\62da4f9656a3aedc50c0510dc6efe9c3_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:2180

\Windows\SysWOW64\xhqq.dll

Filesize
13KB

MD5
9382be0ecf22f0a7eadf525eaa7cea0b

SHA1
43c6d119bd43c714de1ee9a6fccabe49b5edd87f

SHA256
01f47207a8ec12d876416b47fdf23251e7fd09c3e411a48c216bc7d715674ddf

SHA512
cd6b53a16093f467aaf32ba77814c755d93d1d0428df9934dbbdcbd984dadaaadef8ab34c331e01a81d1ad567f06d4514388aec2a555dba755851355039c18a2

Download Submit
memory/332-3-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download
memory/332-7-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download