4a4ff30228a0254b04e67c630f2716950f355da83cd6baf2017e4dbe6bf97135

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 03:34

Target

e91e7d556a7d8828b75d2c6e1193ce7c_JaffaCakes118.exe
Size

42KB
MD5

e91e7d556a7d8828b75d2c6e1193ce7c
SHA1

8f39c3faf392d384ac3482a26c1bc181829a819b
SHA256

4a4ff30228a0254b04e67c630f2716950f355da83cd6baf2017e4dbe6bf97135
SHA512

5d23c32c0799d1fa539393ae003d36b864ef4bc6731af133393aee88e3f06e5ea5a90f01ce1d1f93c63c8320dafa0eb35ab6f5e4d42e2c24ca8d001d438c7fd8
SSDEEP

768:eTyLupzIWzJauO/c/JYDswueJfXBc7Ivbk:Uwupz2it+JJc7IvA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4108	msnmsgs.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msnmsgs.exe	e91e7d556a7d8828b75d2c6e1193ce7c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgs.exe	e91e7d556a7d8828b75d2c6e1193ce7c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe	msnmsgs.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4108	3900	e91e7d556a7d8828b75d2c6e1193ce7c_JaffaCakes118.exe	90
PID 3900 wrote to memory of 4108	3900	e91e7d556a7d8828b75d2c6e1193ce7c_JaffaCakes118.exe	90
PID 3900 wrote to memory of 4108	3900	e91e7d556a7d8828b75d2c6e1193ce7c_JaffaCakes118.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2828

C:\Windows\SysWOW64\msnmsgs.exe

Filesize
42KB

MD5
e91e7d556a7d8828b75d2c6e1193ce7c

SHA1
8f39c3faf392d384ac3482a26c1bc181829a819b

SHA256
4a4ff30228a0254b04e67c630f2716950f355da83cd6baf2017e4dbe6bf97135

SHA512
5d23c32c0799d1fa539393ae003d36b864ef4bc6731af133393aee88e3f06e5ea5a90f01ce1d1f93c63c8320dafa0eb35ab6f5e4d42e2c24ca8d001d438c7fd8

Download Submit
memory/3900-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4108-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download