be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 10:19

Target

0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe
Size

314KB
MD5

0517aab7a1ab0f70c220e89ef692ca46
SHA1

92c6798c75f0cbaa275fa98c5e15745bd7227af0
SHA256

be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd
SHA512

04c2b8d5fb442d264e87e79eb535520a548f6d6a4f233061633dbc88ea9dc774adadc23a65805dd2d7c2ce7f87b60fd6a37d2e7e958e80996102df9c5995ce3f
SSDEEP

6144:eM1pcGTgYA2soLUyRfLIDvLHFyKtJQyslIiSHCwg21j:eOczin/l2v7FttKIAkj

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2856	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2856	2204	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2856	2204	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2856	2204	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2856	2204	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Deleteme.bat
  2⤵
  - Deletes itself
  PID:2856

C:\Windows\SysWOW64\Deleteme.bat

Filesize
212B

MD5
e4f9af37641dd28230274328b48d7a55

SHA1
3a969b8e7165522fec6e173021199333cec83332

SHA256
a0f57f25086303cf90efeb07440723be22d8f6adb4bd4389e919f57a88ea562d

SHA512
5f724f39de12f33750620b8216514cffd539cbf54ab0fa89d5fdc5642a92ef20cd3133654a047279098e0776b420ad9755a26fdc8da16db19980abbbbe2694f6

Download Submit
memory/2204-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2204-2-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2204-11-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download