29d435e6f500ebb2ed7441583af4eaad1e4c541513511164fc7e3f22b6080f3d

Analysis

max time kernel
147s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 22:41

Target

00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
Size

267KB
MD5

00f0042c6bb29af663af169c5b56e12c
SHA1

04187fd62420673775e6d9c240c13ad3aedfefea
SHA256

29d435e6f500ebb2ed7441583af4eaad1e4c541513511164fc7e3f22b6080f3d
SHA512

26fcdd1230e571520d71edd4728df1a981101eb4cacd9843478670387b7d362b4b5e5c5835cbc6bb71cbb941b6a10283949322c189ce12e0c23d3e6a86c2ff35
SSDEEP

6144:WxvyW7ubPVWCW6Nwho2gJWR0bxL03OwAB/Pl:HWibPV5WLkLbxL03Od

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3056	G_Server1.23.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\G_Server1.23.exe	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
File opened for modification	C:\Windows\G_Server1.23.exe	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
File created	C:\Windows\Delete.baT	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	G_Server1.23.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3592	992	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	87
PID 992 wrote to memory of 3592	992	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	87
PID 992 wrote to memory of 3592	992	00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe	87
PID 3056 wrote to memory of 4660	3056	G_Server1.23.exe	86
PID 3056 wrote to memory of 4660	3056	G_Server1.23.exe	86

C:\Users\Admin\AppData\Local\Temp\00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00f0042c6bb29af663af169c5b56e12c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.baT
  2⤵
  PID:3592

C:\Windows\G_Server1.23.exe
C:\Windows\G_Server1.23.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4660

C:\Windows\Delete.baT

Filesize
214B

MD5
ee2ac5eb8b8c3bb83e949ef6b0a1fa9c

SHA1
265110c6d3de72f4939c557f927ce04c270a66a1

SHA256
ccd5bec4733178e26714c94999ebb74ccd8c3a953106f11c724f07375c289798

SHA512
8f304990528ff81855392b05085c4c23fba05a2263dd6dea0c5d9b2a82c66622ecd810843b76645c1b294f59d1771c7c101588f4506d1bafa97157052b1fe718

Download Submit
C:\Windows\G_Server1.23.exe

Filesize
267KB

MD5
00f0042c6bb29af663af169c5b56e12c

SHA1
04187fd62420673775e6d9c240c13ad3aedfefea

SHA256
29d435e6f500ebb2ed7441583af4eaad1e4c541513511164fc7e3f22b6080f3d

SHA512
26fcdd1230e571520d71edd4728df1a981101eb4cacd9843478670387b7d362b4b5e5c5835cbc6bb71cbb941b6a10283949322c189ce12e0c23d3e6a86c2ff35

Download Submit
memory/992-2-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/3056-5-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/3056-9-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download