390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 14:01

Target

3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe
Size

6.7MB
MD5

3fd2140199b02e55d9e8d5b632bfdc71
SHA1

fa1151afe1205c3c9ed2b1b0d90bef37b7e15acf
SHA256

390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c
SHA512

af552357c03c8c72d928463cd897424e9284f579746f5a3db13428709b2787ca076267cbca4c20d28d65a6fae226b02cb6ca7fff9872610788bb06ccf592dd11
SSDEEP

49152:dmXU3mR+00iS482pQ5gMgy3js/5PBrm3xE+Yfiu9voIe/1kR3K+K4ZQSHCfEVR7h:IE3e+058dbzsy3xE8SZQZcvmIX

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2344	1520	3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe	28
PID 1520 wrote to memory of 2344	1520	3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe	28
PID 1520 wrote to memory of 2344	1520	3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe	28
PID 1520 wrote to memory of 2344	1520	3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fd2140199b02e55d9e8d5b632bfdc71_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
  2⤵
  - Drops startup file
  PID:2344

C:\Users\Admin\AppData\Local\Temp\s.bat

Filesize
305B

MD5
4faf8e8903fe026195576c633795fed3

SHA1
b8c653afb48054b90b9731d5497dc21b8086544f

SHA256
9799096f1064c010cf0a21d797bb5b5151ec4ea288c3f4abb2f700186711e943

SHA512
5774ea1cf5991af16942ff0844fbc6ec302641c76d615b88f4da67d1700382b378dbf8056e30cec5800cc1033a3800252afc322576c047ff0e7e80373f43530c

Download Submit