be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 10:19

Target

0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe
Size

314KB
MD5

0517aab7a1ab0f70c220e89ef692ca46
SHA1

92c6798c75f0cbaa275fa98c5e15745bd7227af0
SHA256

be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd
SHA512

04c2b8d5fb442d264e87e79eb535520a548f6d6a4f233061633dbc88ea9dc774adadc23a65805dd2d7c2ce7f87b60fd6a37d2e7e958e80996102df9c5995ce3f
SSDEEP

6144:eM1pcGTgYA2soLUyRfLIDvLHFyKtJQyslIiSHCwg21j:eOczin/l2v7FttKIAkj

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 4860	708	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	86
PID 708 wrote to memory of 4860	708	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	86
PID 708 wrote to memory of 4860	708	0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:4860

C:\Windows\SysWOW64\Deleteme.bat

Filesize
212B

MD5
e4f9af37641dd28230274328b48d7a55

SHA1
3a969b8e7165522fec6e173021199333cec83332

SHA256
a0f57f25086303cf90efeb07440723be22d8f6adb4bd4389e919f57a88ea562d

SHA512
5f724f39de12f33750620b8216514cffd539cbf54ab0fa89d5fdc5642a92ef20cd3133654a047279098e0776b420ad9755a26fdc8da16db19980abbbbe2694f6

Download Submit
memory/708-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/708-2-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/708-1-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/708-3-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/708-6-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download