19117a8931b01cf6f484412f85fe53b7d603945b8ac3fc998f3dcdc9281cac37

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:59

Target

100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
Size

357KB
MD5

100290b556fe70059997cef43b8a71ec
SHA1

20526f5f281b64e7387e07578a8237140f23a8f6
SHA256

19117a8931b01cf6f484412f85fe53b7d603945b8ac3fc998f3dcdc9281cac37
SHA512

74d2dd164b9c99e595fd8eea2a486d914307967429c8e8c006ae39216d788957aff6d10e7247a4255c91f147cdd272a9be9f4a67aba964f23565a1cde52579dc
SSDEEP

6144:b54DvCTZDx5U4MNf6NQO9XRu1YmLq8Enw1eDexz2/bAYDmb03L+nDwFLiEdjc:b5Qv6ZDjUnNfUQ681FuNnCeD8KDAsmb6

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2096	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1300	servicas.bat

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\servicas.bat	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
File opened for modification	C:\Windows\servicas.bat	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
File created	C:\Windows\servicas.dll	servicas.bat
File opened for modification	C:\Windows\servicas.dll	servicas.bat
File created	C:\Windows\UNDEL.BAT	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1300	servicas.bat

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2096	2360	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2096	2360	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2096	2360	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2096	2360	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	29
PID 1300 wrote to memory of 480	1300	servicas.bat	6

C:\Users\Admin\AppData\Local\Temp\100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\UNDEL.BAT
  2⤵
  - Deletes itself
  PID:2096

C:\Windows\UNDEL.BAT

Filesize
218B

MD5
eb02fc68f8967b46ad072c90178663c4

SHA1
572a86d5ce92ee43ff6c715c778896c7d0005541

SHA256
02745fcd62d9bad47aecdba71137d7a530df18a4e5650f369e3f4fcb4d9b62da

SHA512
9c14617a8f49e492e9c0ec5e8cb1cc56d11fb85255b8fbea6b89745a8871c57bc789e3f89cf94397f699bd533a27f2f5c37737472914bd0b7dc57906c10f3e06

Download Submit
C:\Windows\servicas.bat

Filesize
357KB

MD5
100290b556fe70059997cef43b8a71ec

SHA1
20526f5f281b64e7387e07578a8237140f23a8f6

SHA256
19117a8931b01cf6f484412f85fe53b7d603945b8ac3fc998f3dcdc9281cac37

SHA512
74d2dd164b9c99e595fd8eea2a486d914307967429c8e8c006ae39216d788957aff6d10e7247a4255c91f147cdd272a9be9f4a67aba964f23565a1cde52579dc

Download Submit
memory/480-16-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/1300-4-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/1300-17-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/2360-0-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/2360-14-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download