1ffa8a5e7920aad8eed12d3b8cad4734bc70f5574803068c7cced5c1c191492d

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 03:00

Target
16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe
Size 1008KB
Sample240329-dhhheage77
SHA256 1ffa8a5e7920aad8eed12d3b8cad4734bc70f5574803068c7cced5c1c191492d
MD5 16c029b794fdb69a481fb51b8d02a2c8
SHA1 1eff5580689b6c8672c00d52beb3efd3741fd77c
SHA512 1291376d0000d8d7fe19f7f7907d25ac4b6f9977ac1a0135d29746723834217290998867e9648e7b424fda210bce43d2832bde6e95777a9971424deaf92ebc62
SSDEEP 24576:dgdhhQGGnnazLpj4VHogiuGPYEZXT60D2+RQraWDw1D:dqgazxcGPtjD29aWK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4728	cotijoqtq.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bmn\cotijoqtq.exe	16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4728	2416	16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe	84
PID 2416 wrote to memory of 4728	2416	16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe	84
PID 2416 wrote to memory of 4728	2416	16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16c029b794fdb69a481fb51b8d02a2c8_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\bmn\cotijoqtq.exe
  "C:\Program Files (x86)\bmn\cotijoqtq.exe"
  2⤵
  - Executes dropped EXE
  PID:4728

cotijoqtq.exe

Path C:\Program Files (x86)\bmn\cotijoqtq.exe
Size 1.0MB
SHA256 1c1417637e8878dbb3be5243697029677d7fa5cc370d69081e51ca6327f8cd49
MD5 90b9aad519fdfd167f6c28d167cbbbbf
SHA1 59d162ba2ad3942cd131a6f6266fda4cd2ebf1c5
SHA512 cb6fd2a1636ea086770bd404ce09bb10ae357e669adfd44b5f8c10658b7bedaee4e096ba671c9aaa3fa55e90da04f0f314605c23c7e783337dd91fb2661f6239
SSDEEP 24576:dgdhhQGGnnazLpj4VHogiuGPYEZXT60D2+RQraWDw1h/:dqgazxcGPtjD29aW+/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2416-4-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/4728-5-0x0000000000400000-0x000000000045A000-memory.dmp

Download