e66093cbd415872be495b4c5885c40390783007bfcb50423bdb51c51623382b0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 21:29

Target

422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe
Size

3.0MB
MD5

422b269df7789ef6a00b393bc376722f
SHA1

71b730711bf22e81eafd27309304dde1296561f5
SHA256

e66093cbd415872be495b4c5885c40390783007bfcb50423bdb51c51623382b0
SHA512

2d93b1a795778dbca8bd989e0dad06907f17259f2718ae8bf5b82382fb3ebf17db4b30be2db5408e8100e6ee1255c7fbb863b5e6e377cf0155c745834fae0767
SSDEEP

98304:ODnoy0lyag6B8If0FZowSlPThFb0vt02ReGho5vBOVNvx:DHNFYvt0wkZkNZ

Score

1^/10

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1268	2828	422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe	28
PID 2828 wrote to memory of 1268	2828	422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe	28
PID 2828 wrote to memory of 1268	2828	422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe	28
PID 2828 wrote to memory of 1756	2828	422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe	29
PID 2828 wrote to memory of 1756	2828	422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe	29
PID 2828 wrote to memory of 1756	2828	422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe" /restart
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\422b269df7789ef6a00b393bc376722f_JaffaCakes118.exe" /restart
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1756

C:\Users\Admin\AppData\Local\Temp\Settings.ini

Filesize
320B

MD5
200be48b3d46b71cc5557e9fa0f8e820

SHA1
b4287c7051550857fc6a2c9afbc46d7c985945bc

SHA256
02759560f08904a693ce8b664c24d7de95ebe24a5192eb36bdc8d8eed12a7011

SHA512
85515b872dffe24d7b420ca83320b60c2a774b8ff2dabce6b20298806fb6975a571de16e6ff6922cdbba0f436c3ae4ecedf66248f06d692f5d80e3e3e64b6068

Download Submit