22700204d42498f774aa3bfdbb65981789903938f18b2e749ae4881d0d9fc42b

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 11:19

Target

20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe
Size

1.9MB
MD5

20b4cf28d5c333c398b064b9ad807469
SHA1

47c14e2c7dd597da2be20b3a413be361999e92e5
SHA256

22700204d42498f774aa3bfdbb65981789903938f18b2e749ae4881d0d9fc42b
SHA512

68e973ba2a9e03a186faae6bc62974dff8f394d444c096039b3b1ce5a141fc1a04372bf3a3f634a077e26ef2105f2bbc7b45775ea31811bef236399253278069
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dovsJU7P4AnPaGHtk+rz7T+MvE2ktJOlJlR/I:Qoa1taC070doNQAPPN13+Ojly

Score

7^/10

Deletes itself 1 IoCs

pid	Process
32	C30.tmp

Executes dropped EXE 1 IoCs

pid	Process
32	C30.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 32	820	20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe	95
PID 820 wrote to memory of 32	820	20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe	95
PID 820 wrote to memory of 32	820	20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\C30.tmp
  "C:\Users\Admin\AppData\Local\Temp\C30.tmp" --splashC:\Users\Admin\AppData\Local\Temp\20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe 5D573519DC2157422FB3728EF911BBED9EA064237CE31768B9EB96EE82A7A981969D260A5C68A625ED0DA988E72E0492F38F77F7DD26611EA90D997D89B3A917
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:2444

C:\Users\Admin\AppData\Local\Temp\C30.tmp

Filesize
1.9MB

MD5
ea65e7307485ef652038cb259ae68125

SHA1
5431922a7225934b00ff915577b593b9acda43ea

SHA256
777a9f5ab71f15a6e163a9200330ac3a16c08f8ac98136c4743ddc59f29b6ea6

SHA512
980baf341a9cb0b922f6e237197cec85b0ea6e89ef8544678c03aee9994037a7ba13404bdd539623eec9c783e611a292b0adfe07072e76eb77e67f787865f949

Download Submit
memory/32-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/820-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download