51720c15de54118cc6d6a9fde35fa549428fe5ce499e30fca4b98cf4f9cb2cfa

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 23:40

Target

930152f5021c136910164967be2c2f47_JaffaCakes118.exe
Size

60KB
MD5

930152f5021c136910164967be2c2f47
SHA1

2e831736539c88493af016389ea9460ec7a32289
SHA256

51720c15de54118cc6d6a9fde35fa549428fe5ce499e30fca4b98cf4f9cb2cfa
SHA512

1aa4768cc5d2d42dff82fc22c0d60cf29d0396878228e08e1593eefbee88dd5856adda54355667dfd186b6163385342f6cc9f7660d27a3201f7959b7aa5bdcd7
SSDEEP

768:c2wZtOMDkvgTejnD9wX5qXgXT/JdfF6PsA4pkPFQ:jwyTvgCjnD851j/DQkAbQ

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 drive.google.com
3 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

930152f5021c136910164967be2c2f47_JaffaCakes118.exeRegAsm.exe

pid process

2620 930152f5021c136910164967be2c2f47_JaffaCakes118.exe
1300 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

930152f5021c136910164967be2c2f47_JaffaCakes118.exe

description pid process target process

PID 2620 set thread context of 1300 2620 930152f5021c136910164967be2c2f47_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

930152f5021c136910164967be2c2f47_JaffaCakes118.exe

pid process

2620 930152f5021c136910164967be2c2f47_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

930152f5021c136910164967be2c2f47_JaffaCakes118.exe

pid process

2620 930152f5021c136910164967be2c2f47_JaffaCakes118.exe

flow	ioc
5	drive.google.com
3	drive.google.com

pid	process
2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe
1300	RegAsm.exe

description	pid	process	target process
PID 2620 set thread context of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe

pid	process
2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe

pid	process
2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

930152f5021c136910164967be2c2f47_JaffaCakes118.exe

description	pid	process	target process
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe
PID 2620 wrote to memory of 1300	2620	930152f5021c136910164967be2c2f47_JaffaCakes118.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\930152f5021c136910164967be2c2f47_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1300

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

memory/1300-5-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2620-2-0x00000000002D0000-0x00000000002D7000-memory.dmp

Filesize
28KB

Download
memory/2620-3-0x00000000777A1000-0x00000000778A2000-memory.dmp

Filesize
1.0MB

Download
memory/2620-4-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2620-24-0x00000000002D0000-0x00000000002D7000-memory.dmp

Filesize
28KB

Download
memory/2620-25-0x00000000002D0000-0x00000000002D7000-memory.dmp

Filesize
28KB

Download