f6c73d7fdc907bae32cf8186affc75760dfddb501713254c3c12d058162a5713

Analysis

max time kernel
130s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:14

Target

2f4867cb1fac9eeebba59603eb1dc96b_JaffaCakes118.exe
Size

6.7MB
MD5

2f4867cb1fac9eeebba59603eb1dc96b
SHA1

64dd4a6cebc95ab879ddc6bb5e93f90500135fde
SHA256

f6c73d7fdc907bae32cf8186affc75760dfddb501713254c3c12d058162a5713
SHA512

14b763ebda3d3e057bdfbe4a928f4bddfd0fdd265e6e6d75f41c794441fc10dedaf903b1b23436683528642ba06f798ce10b1a2442a387d55beff35ff79d8d32
SSDEEP

49152:DmXUXmR+00iS3cRpQ5A8gCGDs/5PBUm3Rf+Yfiu0vIIe/1kR3K+K4ZqSeCfEVR7h:iEXe+0Cc6nesZ3RfbSZqScvmIX

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2488	3632	2f4867cb1fac9eeebba59603eb1dc96b_JaffaCakes118.exe	81
PID 3632 wrote to memory of 2488	3632	2f4867cb1fac9eeebba59603eb1dc96b_JaffaCakes118.exe	81
PID 3632 wrote to memory of 2488	3632	2f4867cb1fac9eeebba59603eb1dc96b_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\2f4867cb1fac9eeebba59603eb1dc96b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f4867cb1fac9eeebba59603eb1dc96b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
  2⤵
  - Drops startup file
  PID:2488

C:\Users\Admin\AppData\Local\Temp\s.bat

Filesize
305B

MD5
18ccaf8c74d46bf9841a2db03317b212

SHA1
b8f6717024dbf1c4dc67138daf2c44f8b01cd65d

SHA256
6409389cc7caa3a66f85df3a8e70a0095139b0c248f425cd73f0c077b00f12ac

SHA512
309556cbede4b1e3640db21456d91bc9e18093d037ce30ed0d344fd0d8c4bf83e75ceee033ed9f82340aa53d18f03a3e493476035953f7074a73f58a2427c827

Download Submit