82dea2dd91683744679773f49e0d826e235537cade5a503f66147dd127808016

Analysis

max time kernel
114s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 13:03

Target

22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe
Size

1.9MB
MD5

22b0738e6d4c50e4f68995a118c222ec
SHA1

11ff1041872941c7125cea14f671df17ca28d5ea
SHA256

82dea2dd91683744679773f49e0d826e235537cade5a503f66147dd127808016
SHA512

b8286bea4272b35a633c8fc6ee8bebd4cea73a87392f756c8e9dec413855fa609855e64dd75c1541afb52614b06d325c077f69ebc607604bbd0b0ab058a11b79
SSDEEP

49152:Qoa1taC070dOBbpNW9FbVoPTIfugch5LL8BH:Qoa1taC0z9NWDbeP7Lw

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4672	8899.tmp

Executes dropped EXE 1 IoCs

pid	Process
4672	8899.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 4672	2288	22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe	95
PID 2288 wrote to memory of 4672	2288	22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe	95
PID 2288 wrote to memory of 4672	2288	22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\8899.tmp
  "C:\Users\Admin\AppData\Local\Temp\8899.tmp" --splashC:\Users\Admin\AppData\Local\Temp\22b0738e6d4c50e4f68995a118c222ec_JaffaCakes118.exe D7F78BC0CFB213F5F8FD3DDFFBE86E9D309B83D3A55B1FD789EE1E88C2C3F400769F50AED1FB59AD445B55FCA9AE23EF4294B649D93F68A024D282268AF06DD1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:3228

C:\Users\Admin\AppData\Local\Temp\8899.tmp

Filesize
1.9MB

MD5
1483e7258cab2d4c9dfa36428511a46a

SHA1
48dbf3b1367764a91c548a08fcb6bb1754629d47

SHA256
915c137e17cbadaac2161617138b10c39eee8886bd9712560610f3e9bb262449

SHA512
5fe8d8c82e585bb795b3a7b38918dfa52fedb7488ffa7c23cb874b00a0ba4bb6cc2cd4463f3b50808a2f87c250cbb3d983f37bd9f28bc3e95f7ca1ff4f9b53b2

Download Submit
memory/2288-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4672-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download