36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 09:36

Target
d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe
Size 1.9MB
Sample240405-llakzaha73
SHA256 36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64
MD5 d0121aafc70d2e972ee1d23b3460a856
SHA1 2d2015fae69a934832da394d27e93366d5a68b67
SHA512 d9f7adedecba0c92adc1fd0f36627edb313bc4bf3031c9555e3541fb47d945ae4eaf000ed7f3894a0adda5bb37548c6cfda5d5ea3b3d23c2737d4824f44cf3b2
SSDEEP 49152:Qoa1taC070dpTubkoDGaXoJgPCzB6J2KZ:Qoa1taC0kfMsu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1192	4083.tmp

Executes dropped EXE 1 IoCs

pid	Process
1192	4083.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 1192	4324	d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe	89
PID 4324 wrote to memory of 1192	4324	d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe	89
PID 4324 wrote to memory of 1192	4324	d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\4083.tmp
  "C:\Users\Admin\AppData\Local\Temp\4083.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe B0D73B3471D1253F98D8633594D5C9392D8BF8F9CCB2488A4AE2C3345A60A3D4DC7C0EE0EDFB1778773F47C3389E8180C3662DE6AEA6993923AC54A25F3DA49E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1192

4083.tmp

Path C:\Users\Admin\AppData\Local\Temp\4083.tmp
Size 1.9MB
SHA256 c77c15852e999a4739237085063f299682311235e31c5cc32a3e19a87c4dee87
MD5 99be2eff4de49c5bdae289f916f5124e
SHA1 8baecd818efe0648967c3cb60344c234f03ea386
SHA512 48ab986b3bb60abb6d1467f4dc14460e06666af2d83e17df872f817bc17dd1e9e14a75842b825478437988757370bf936fd7984531018aa1ba0adb46f38cc373
SSDEEP 49152:Qoa1taC070dOVwEs69UOASo9/++ZoZprKQkcy:Qoa1taC0KlnV+MN5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download