eca726c15448d6acd6c2fe034cda1f78530b42c14bbd3f96123ec907d05adad4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 13:37

Target

e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe
Size

1.9MB
MD5

e2a85d470720504b32bbf1fff62a57dd
SHA1

bb1bf887bc6735a85a6457c506a260ccf3a1b950
SHA256

eca726c15448d6acd6c2fe034cda1f78530b42c14bbd3f96123ec907d05adad4
SHA512

8bcbf858cd94685567a4520528899a8cf503d89c400825ec80a0e209f2ae350f69a3fac3da8161cb9c8f64ebfc5659a82164a855d907c29a22a33d752c896190
SSDEEP

49152:Qoa1taC070dmccczQp454rEN720qEWgTFXvcmYdsM:Qoa1taC0JTm2ru720wgKt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3252	8211.tmp

Executes dropped EXE 1 IoCs

pid	Process
3252	8211.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3252	4720	e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe	96
PID 4720 wrote to memory of 3252	4720	e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe	96
PID 4720 wrote to memory of 3252	4720	e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\8211.tmp
  "C:\Users\Admin\AppData\Local\Temp\8211.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e2a85d470720504b32bbf1fff62a57dd_JaffaCakes118.exe B368B7EB2516657FE5B62CF117AACDE9D473588F56487DA7AE9DCC0CFCDE21CE449CFDDF6F2614D7EA217A67657FE32DCF9415FEEB845280EC8D1BE5D019DBD0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3232 --field-trial-handle=3408,i,16599691418790971742,134777455365707676,262144 --variations-seed-version /prefetch:8
1⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\8211.tmp

Filesize
1.9MB

MD5
633388a5cceb7e9ab5fbbdf730b2111b

SHA1
f7fe4695835281e2a2bfd4334d9c4899cee39790

SHA256
df65eacd63fd2d83b1f9caffdbf56487b34759f5cca6b55e42e39c6252c7d340

SHA512
cc358550f1f07466978f10a8e4e47ef7899ff2b7acd8a8fea404f2d7650533415108c5ae9f9cd75870ed9189c1a133d8b9f454f41d0ac33d6de1b9c54c25fa9b

Download Submit
memory/3252-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4720-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download