b278c83cb2bd5b1dccd6d5fab6d3bbc29fc5ba4149450935ee9a4d618d0f5066

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 10:28

Target

05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe
Size

301KB
MD5

05268db45422d0d7372eda3ee89fe504
SHA1

ab2ecc6323b5e492670993d5587f4c9176b7f1ee
SHA256

b278c83cb2bd5b1dccd6d5fab6d3bbc29fc5ba4149450935ee9a4d618d0f5066
SHA512

2be37a209b95ec679216ab2d617bce730d7c33e52026dfadc105966fb7a51e3ef33c24e34c0ba7e6b946aa4b786f822aab29992efde35da13955a7e0fc9abbe0
SSDEEP

6144:alByr8TQmfqSUKzjLgG124I6PzZXxq3HSU2wbqfq/ZToQN:aLygPYK/LF12bm903xMfCZUQN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
744	Bitoot

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Bitoot	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Bitoot	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Delete.bat	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
744	Bitoot

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 3960	836	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	86
PID 836 wrote to memory of 3960	836	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	86
PID 836 wrote to memory of 3960	836	05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05268db45422d0d7372eda3ee89fe504_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  PID:3960

C:\Program Files (x86)\Common Files\Bitoot

Filesize
301KB

MD5
05268db45422d0d7372eda3ee89fe504

SHA1
ab2ecc6323b5e492670993d5587f4c9176b7f1ee

SHA256
b278c83cb2bd5b1dccd6d5fab6d3bbc29fc5ba4149450935ee9a4d618d0f5066

SHA512
2be37a209b95ec679216ab2d617bce730d7c33e52026dfadc105966fb7a51e3ef33c24e34c0ba7e6b946aa4b786f822aab29992efde35da13955a7e0fc9abbe0

Download Submit
C:\Windows\Delete.bat

Filesize
214B

MD5
96fd497cc751bca47811bae514b979ed

SHA1
cefcba369e4fc6d3ee90768eed068952f05c2258

SHA256
18a941cd54f3724e185fa0f1fde2565e0ce25f7b03f0cd3d5874bcf92d5f303a

SHA512
9262f50745c04fd464819027eb131198b790108daa12956aa43f893fd59fe00565eea33cc217a7051aebb5cc5c916660b6c4dcc39c1a4f9518552150478c0ccb

Download Submit
memory/744-6-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/744-11-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/744-12-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/744-13-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/836-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/836-3-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/836-9-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download