df28ef859f088a7eda05630390e17795e10c0c90e03629fe6a8162b29e84115f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 00:42

Target

efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe
Size

1.9MB
MD5

efe7089b555c5251b9ed5282b2a398c6
SHA1

ce40ef5e347e024a7bb0f982a9477915545f82d2
SHA256

df28ef859f088a7eda05630390e17795e10c0c90e03629fe6a8162b29e84115f
SHA512

799a7792ae83f3167cdca6a20d117c715094a895069b6f9ab439362b7e8577ab3982eeb84bfc19a01d8113b2d49360b5cb280597076d3e4155aa7fa128c38205
SSDEEP

49152:Qoa1taC070dTLjydPRrlKGg9mMgmkVcRq:Qoa1taC0qjARBuIMgm+c4

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1652	660D.tmp

Executes dropped EXE 1 IoCs

pid	Process
1652	660D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1652	4544	efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe	86
PID 4544 wrote to memory of 1652	4544	efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe	86
PID 4544 wrote to memory of 1652	4544	efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\660D.tmp
  "C:\Users\Admin\AppData\Local\Temp\660D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\efe7089b555c5251b9ed5282b2a398c6_JaffaCakes118.exe 5B1CC908E1F82C2B1ED8EB784D289DA99379B88E8B19D73E960D0A8E04C54AD9F500274AFBF45C50386821FDC708559625626D1B31F37E8E5EB6237F8FA1F49E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1652

C:\Users\Admin\AppData\Local\Temp\660D.tmp

Filesize
1.9MB

MD5
bcecdcddbfe9d405f260cd652e5cef24

SHA1
286234334efeb59ce11353c55a629a6227beea91

SHA256
1a5c6611502f376e1a4c59c069712d2946cf9f171bb204236a150b9af6e39947

SHA512
081e3e339e46b7fb95e2353019d22c168d75563f83a5aa9e8df51121b4ad7ad8e18ea9bf22bbd270676a61d6e7c6857c9fed00b1eb6fe9070c73527911c658be

Download Submit
memory/1652-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4544-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download