8e6692ffd21dfa2f008d6348f80f2df53ade98f50eecd22cacf20dc6d93a5fe9

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:42

Target

2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe
Size

1.2MB
MD5

2824bd86016186910e1fe4fccffd10d9
SHA1

fab37e7df929bf6b794ea7f5724d50113d1083bd
SHA256

8e6692ffd21dfa2f008d6348f80f2df53ade98f50eecd22cacf20dc6d93a5fe9
SHA512

cc064586058f2d8fad320e5d976dd0b3b938946429abe3776474ed56242c9c371002234c1d9090922bf19d0cbef15ad3750931d107ca93e72ef6191ea3eac3ec
SSDEEP

12288:rsecHSyXDzw5St9Ywdx1TOOebDF+2dLkWSABIi7ALcuTELfktjRT42gq7Z4pTAR:rsmVS7Ndx16NYW3Ii0rTEyRT4C7yUR

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
912	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 1044	912	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	87

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 912	2296	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	80
PID 2296 wrote to memory of 912	2296	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	80
PID 2296 wrote to memory of 912	2296	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	80
PID 912 wrote to memory of 1044	912	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	87
PID 912 wrote to memory of 1044	912	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	87
PID 912 wrote to memory of 1044	912	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	87
PID 912 wrote to memory of 1044	912	2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\{D06D4491-318D-4E9C-B301-7298A2583EB7}\2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\{D06D4491-318D-4E9C-B301-7298A2583EB7}\2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe /q"C:\Users\Admin\AppData\Local\Temp\2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{D06D4491-318D-4E9C-B301-7298A2583EB7}" /IS_temp
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\system32\explorer.exe
    3⤵
    PID:1044

C:\Users\Admin\AppData\Local\Temp\{D06D4491-318D-4E9C-B301-7298A2583EB7}\2824bd86016186910e1fe4fccffd10d9_JaffaCakes118.exe

Filesize
1.2MB

MD5
2824bd86016186910e1fe4fccffd10d9

SHA1
fab37e7df929bf6b794ea7f5724d50113d1083bd

SHA256
8e6692ffd21dfa2f008d6348f80f2df53ade98f50eecd22cacf20dc6d93a5fe9

SHA512
cc064586058f2d8fad320e5d976dd0b3b938946429abe3776474ed56242c9c371002234c1d9090922bf19d0cbef15ad3750931d107ca93e72ef6191ea3eac3ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D06D4491-318D-4E9C-B301-7298A2583EB7}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D06D4491-318D-4E9C-B301-7298A2583EB7}\_ISMSIDEL.INI

Filesize
756B

MD5
f70ef50ab3685764b7e0492100618038

SHA1
1c909d18e28bca7df2234ea76120cd54e179662d

SHA256
2ef9503921e3a244beeeb2ff040d5d6f45de4a18b570ecca21612418024b3a76

SHA512
6d77e9e55c70b30368182f850bfc35d0b0ed32ab2b057742b560bcb022ad1ca7978a96d89a3fd09aea6702f461490159382f030ab5c4ba6dbb3fffe3a1decf18

Download Submit