15ff1f5aae959faccbed36e8fc39a2f89c6dc8645e589ec91a1412115d01973a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 20:19

Target

f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe
Size

1.9MB
MD5

f1d74b1487a6b3a8835ce7643ef5f0d8
SHA1

634947a6ade14069cc87366ea1ec8d998f80d6fc
SHA256

15ff1f5aae959faccbed36e8fc39a2f89c6dc8645e589ec91a1412115d01973a
SHA512

01a955e54d74682fb2639d3285765bc36a756d7a2f80211a454bc9c81db16857bd75766eb50c1e8fab40f1c203767b99bffa8db84a0a37548d53e3cad99ed849
SSDEEP

49152:Qoa1taC070dKLQ9X3Do3J3ppZoLPmDA+9XoOTZ:Qoa1taC0CF3Do53yLD+OY

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4448	DA7.tmp

Executes dropped EXE 1 IoCs

pid	Process
4448	DA7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4448	4752	f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe	91
PID 4752 wrote to memory of 4448	4752	f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe	91
PID 4752 wrote to memory of 4448	4752	f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\DA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\DA7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f1d74b1487a6b3a8835ce7643ef5f0d8_JaffaCakes118.exe 6AF02C4F9DB2A025AA2CE056899E4D910D6FA60DDB46BFE8DFECEE6D0C8CC4B549690C32043A439B933D86F7EE13E57D93D9A8902B4130E4D38DB0C02EE51930
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4768

C:\Users\Admin\AppData\Local\Temp\DA7.tmp

Filesize
1.9MB

MD5
716a4f46a103cf79b01076aff13f1387

SHA1
0d5d67d4448ebf9a1bf7706e2b7232e50d8ff3e9

SHA256
acf3bf42eb7b383cae76fe32a10fe17fb3f7996f71399fdbeac1798b27a85f43

SHA512
e4ae48b18ff84d8df14ac0d66c81fa93518fb0de7eeaf71f7856850b0112eb1fedd90466b2afd1b0081f741f3a0a52f90be804267a771575cb9910ab02b82b17

Download Submit
memory/4448-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4752-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download