dfe88c60f40c6833de847c67d3ce521854adaf7e659e9ef67fd90402f44ae00b

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 20:02

Target

c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe
Size

383KB
MD5

c17d831084e06900d704093c2fe2db99
SHA1

b68f6f94766ba2e16b4754357314bfcf3922fd68
SHA256

dfe88c60f40c6833de847c67d3ce521854adaf7e659e9ef67fd90402f44ae00b
SHA512

69258c707ef3fd3a03fdce17eef3d348627c3bb2f0c2f5dfcea71dc1cbd7d2dcde0f35a9279291a8f45871ec030eda9e8c59a23a00405eb41d0f4e3955382bff
SSDEEP

6144:SYzGVMNbOgV/5W9LPJgqpET3UEQXsyXeqGtMUbiBaUkWPam6GSbCsdENeCn6H:SYzGVM3VyJgeE7uXsQeVtBKNkWPamMCY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2224	piddo.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ttkap\piddo.exe	c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2224	2628	c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe	94
PID 2628 wrote to memory of 2224	2628	c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe	94
PID 2628 wrote to memory of 2224	2628	c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c17d831084e06900d704093c2fe2db99_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\ttkap\piddo.exe
  "C:\Program Files (x86)\ttkap\piddo.exe"
  2⤵
  - Executes dropped EXE
  PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4196

C:\Program Files (x86)\ttkap\piddo.exe

Filesize
392KB

MD5
5e583e265e2ff1a90233b5bb19592971

SHA1
27add58d9a40e08073d74d8a130627354bc5ae92

SHA256
bea2a38ee1f0dc1e4c0bf44bc09c9470818d93577a04e0f4c3735be0e2a3e9b8

SHA512
b9038670d192723504cec36d301b426e255ba173ee27ee3ff168e08954d5edbf83af01f492ece2de538c8ba8757ef4528f1bcf4bb5c636eb1530a5d86b1760cf

Download Submit
memory/2224-7-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2224-8-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2628-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2628-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2628-6-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download