fc269aa2bb1ff91db0564cc9e1d6a6b4cfb74225f14c24c087e6952abcb28d32

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:39

Target

ab96ab663c6838cb9b9f12578323e031_JaffaCakes118.exe
Size

333KB
MD5

ab96ab663c6838cb9b9f12578323e031
SHA1

35256d045d40de1c5b3bbd6600084f841f7ef0c2
SHA256

fc269aa2bb1ff91db0564cc9e1d6a6b4cfb74225f14c24c087e6952abcb28d32
SHA512

4ab54092a5186b15047e9f66727749c149609ec10fc974ceb90fee307b4fe8f20fca600013d3ad8b51e480cbdf16746cf0758ae89b12b106e8cddb2edc3292a4
SSDEEP

6144:NoE/LBNnBsUagx5Irb7cJdoOSmE/LBNnBVUagx5Irb7cJdoOScT+J3aBPANE/LBm:NJ7slgIfkoLT7VlgIfkoLcyJqBx7Vlg8

Score

1^/10

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
2324	bcdedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2324	828	ab96ab663c6838cb9b9f12578323e031_JaffaCakes118.exe	30
PID 828 wrote to memory of 2324	828	ab96ab663c6838cb9b9f12578323e031_JaffaCakes118.exe	30
PID 828 wrote to memory of 2324	828	ab96ab663c6838cb9b9f12578323e031_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ab96ab663c6838cb9b9f12578323e031_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab96ab663c6838cb9b9f12578323e031_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /deletevalue safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2324

memory/828-0-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/828-1-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/828-2-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/828-3-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/828-4-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/828-5-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download