56042f13c376561a18bbb07d01512e3178cb44ff3be70e7d0814a19d0549cfbb

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 12:51

Target

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
Size

112KB
MD5

a0bad57e9f99b74bf3aa862ec8d792fd
SHA1

54b8320cbbfc3ef22bf2641731c39c2efedcf112
SHA256

56042f13c376561a18bbb07d01512e3178cb44ff3be70e7d0814a19d0549cfbb
SHA512

5a185c307e03632bb63c8f88eca32d8c2907dfc15f32f09a122fd0dd1b688448a9bfa17a5013845b0f2610b6f5f3df51cae565b4b36e0aae62b33047133c4a65
SSDEEP

1536:LxIsaRSTBlzHPtipUv+2frPAX77RhC9ipRz33EYod:t8ROlrjrs7OIRj3od

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exeRegAsm.exe

pid process

2148 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
2280 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

description pid process target process

PID 2148 set thread context of 2280 2148 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid process

2148 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
2148 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid process

2148 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid	process
2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
2280	RegAsm.exe

description	pid	process	target process
PID 2148 set thread context of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe

pid	process
2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid	process
2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

description	pid	process	target process
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2400	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 2148 wrote to memory of 2280	2148	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe"
2⤵
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2280

memory/2148-2-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/2148-4-0x0000000076D80000-0x0000000076F29000-memory.dmp

Filesize
1.7MB

Download
memory/2148-3-0x0000000076D81000-0x0000000076E82000-memory.dmp

Filesize
1.0MB

Download
memory/2148-6-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/2148-7-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/2280-5-0x0000000076D80000-0x0000000076F29000-memory.dmp

Filesize
1.7MB

Download