4b7ab9a1f41bd5f82b5bc993eec8cd20d3c64ac954c6ef92f6dff4fb603e794e

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 17:31

Target

0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe
Size

1.9MB
MD5

0bca2b1a5d98e39c030780bf605b28c3
SHA1

903f4543f13e144f950ffee7978ee8b233cba21a
SHA256

4b7ab9a1f41bd5f82b5bc993eec8cd20d3c64ac954c6ef92f6dff4fb603e794e
SHA512

c64dc0ef56c119d4008f68c17ca3d92c7892126601cea9aad8f4ffe21c34700243c6f115d5b8f6ba72ca8720d557d6f23d456529e4916480c0b8557f52bc8c82
SSDEEP

49152:Qoa1taC070dvm9t9YQb+p20QoAHm3DjUsfa1xrijKeFy:Qoa1taC0rthip23oAG33U/7eGeFy

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2140	18B3.tmp

Executes dropped EXE 1 IoCs

pid	Process
2140	18B3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2140	4664	0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe	93
PID 4664 wrote to memory of 2140	4664	0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe	93
PID 4664 wrote to memory of 2140	4664	0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\18B3.tmp
  "C:\Users\Admin\AppData\Local\Temp\18B3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0bca2b1a5d98e39c030780bf605b28c3_JaffaCakes118.exe F217404192D6FDD01427A55C1C02F3313D63F03E356C67826F87A911827199EF4CA7088D549D82AEEE0BCECEE62A73AC69E9B5F54F694432424E47FDDCCCF566
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:892

C:\Users\Admin\AppData\Local\Temp\18B3.tmp

Filesize
1.9MB

MD5
77d49b6031b006c6de517142b7283d2c

SHA1
5cecba8deb95182a29667a2476a878466d22eddf

SHA256
b720f3d28cce5606608d48899d6733ca1c05abf7c155b817a0a65a35b199e3e4

SHA512
162cbac1853df755c40d8850552ca039fc3a6a5ea05b7db0442615532c8fecd2c764792ce23a0e1d24539276ab22a71cbdcefd7720ecbc515d45d14331ac2b6a

Download Submit
memory/2140-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4664-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download