16c2dc5d31cab0c71ffd58ac2f66cdda13169157160f506143e5ad332a06df27

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 06:00

Target

49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe
Size

119KB
MD5

49b44a62c75513c5b47d9097920aebbf
SHA1

adb50a6d6bcc1cb059efa9f478e16ff8ee3b4028
SHA256

16c2dc5d31cab0c71ffd58ac2f66cdda13169157160f506143e5ad332a06df27
SHA512

9ce1943ba713f9ff1def8e34da4afd55870f748eaeb0850c44b273d246f82d94a92f1922c73c5dcb58ff6c78eac61dd93c4ed778e30254d2cdf70a80fc9e01c8
SSDEEP

1536:/UN6DZ4SleCsL6DNr0wHEx3wKW6y8LLdsc6SRoc:MKPe9Y1pExY+0aoc

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4236	2345safe.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\360safe\2345safe.exe	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe
File created	C:\Program Files\360safe\2345safe.exe	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe
4236	2345safe.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 4236	1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe	83
PID 1388 wrote to memory of 4236	1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe	83
PID 1388 wrote to memory of 4236	1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe	83
PID 1388 wrote to memory of 2716	1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe	84
PID 1388 wrote to memory of 2716	1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe	84
PID 1388 wrote to memory of 2716	1388	49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\49b44a62c75513c5b47d9097920aebbf_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files\360safe\2345safe.exe
  "C:\Program Files\360safe\2345safe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a.bat
  2⤵
  PID:2716

C:\Program Files\360safe\2345safe.exe

Filesize
119KB

MD5
49b44a62c75513c5b47d9097920aebbf

SHA1
adb50a6d6bcc1cb059efa9f478e16ff8ee3b4028

SHA256
16c2dc5d31cab0c71ffd58ac2f66cdda13169157160f506143e5ad332a06df27

SHA512
9ce1943ba713f9ff1def8e34da4afd55870f748eaeb0850c44b273d246f82d94a92f1922c73c5dcb58ff6c78eac61dd93c4ed778e30254d2cdf70a80fc9e01c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\a.bat

Filesize
100B

MD5
44ab64f474a6ca5995615df7ac26464a

SHA1
666f61d458302313f4c1da007194fb44d827a27d

SHA256
8c76ec3898c660ed584c016ae05040f9947f02bd8d0eaf31dbd734a6c9a65c68

SHA512
f57e3f0f74877b2494fc48ca62d626ba0d7f653b94d37ffe8b2502a1a832fba55df386dfde1cc85efc056941f7ba5f9ee704a8c20d554d18c9d8163aa9b20936

Download Submit