74d5e109c3204b20d8f9b04662eee70b4d92e36ef2a8f9b74f39035dad019eb2

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 03:01

Target

c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe
Size

1.9MB
MD5

c8f844afae01d26c7cdd1c50205c2971
SHA1

790d8b6f0d060f0d08d35c8c03c7eeee6580c892
SHA256

74d5e109c3204b20d8f9b04662eee70b4d92e36ef2a8f9b74f39035dad019eb2
SHA512

b57e856845202b9ad95254b62f35f81ee6fe25e133049c6e8b2744d630719bf4c3d78631dc6ac3a80c20a731dc1750cf5bbc3395543ebff2342b3a9d5385aea0
SSDEEP

49152:Qoa1taC070db3UwL3uiXAkbHr3xWSlvMaSiULv:Qoa1taC0mu2HhlvMT7

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5432	1596.tmp

Executes dropped EXE 1 IoCs

pid	Process
5432	1596.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 5432	3236	c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe	94
PID 3236 wrote to memory of 5432	3236	c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe	94
PID 3236 wrote to memory of 5432	3236	c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\1596.tmp
  "C:\Users\Admin\AppData\Local\Temp\1596.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c8f844afae01d26c7cdd1c50205c2971_JaffaCakes118.exe C630C2FA7335B28160940AF10750BDAB2F5AF0C6B54660EE515B69026A100E6C5FE6C680D6CF073735B28DAA8CD5ED91186EF0812909AE43EFA0DB1FBC11CE3E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1392 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5600

C:\Users\Admin\AppData\Local\Temp\1596.tmp

Filesize
1.9MB

MD5
c367b5601329f602db421af381dee688

SHA1
ded2d1acfccf4112fe63f0732a03c8442dc9a65a

SHA256
5505a123f11a481613b38ecf067f453f90c7a99f1ba8cd85a55feda9b1f757c2

SHA512
ed84af0a4cc594c4f79b34f4f3c3fdd342b045a6754d2b36eebfe5443d615fa019ca64f731de1c5ba41b281f41ddc8a67b461b781c6d5b3d8f839355ac1ee7be

Download Submit
memory/3236-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/5432-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download