111d6499dd1e96785368e67fcf7e7d1585358e96d5f25627ddccd8eae89458e8

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 05:21

Target

ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe
Size

1.9MB
MD5

ecbf4ca3a13f0b88d3f47397bd6c7387
SHA1

e63664449fcf50e744b6048c3f46137798a11556
SHA256

111d6499dd1e96785368e67fcf7e7d1585358e96d5f25627ddccd8eae89458e8
SHA512

6f02058a0139437c90bb659d211a4f65d0046ddd8eba047392117acaf3f70c4880b9b54529080dbd298c98314d3ab67ac18872058ffc096a4391f438d798af3a
SSDEEP

49152:Qoa1taC070dpct5FogyM47RDMB507YGWhise9q8Q:Qoa1taC0iwolM4iBy8GWhisCm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1724	B6BD.tmp

Executes dropped EXE 1 IoCs

pid	Process
1724	B6BD.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1724	2100	ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe	97
PID 2100 wrote to memory of 1724	2100	ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe	97
PID 2100 wrote to memory of 1724	2100	ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\B6BD.tmp
  "C:\Users\Admin\AppData\Local\Temp\B6BD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ecbf4ca3a13f0b88d3f47397bd6c7387_JaffaCakes118.exe 92AC32E7501BA94A01D57DD511DFB47DC3429C20834100923E97722D5976A23EB628B8E146AEE61C7EE0E33AC57536F5674BFB97D46B21153B7373D2E421A0E2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:8
1⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\B6BD.tmp

Filesize
1.9MB

MD5
482d5e44a3dfe8827e1c5168d83770af

SHA1
335306e1670b732b88cd1fb8c3b58ea7c3a7cb0c

SHA256
968fbd4e4551d3f36908e623876dde31eb9a9aacec5d9da2d5a7bc7e9e0126a2

SHA512
0e8e354c039cec560c276ba2f47041196b912749ef48871bf14d0dc248b57b5e2a2976e482be269b21d82ba90cabdd0ad47ca6144c0dc72fa49a237913a0a945

Download Submit
memory/1724-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2100-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download