19117a8931b01cf6f484412f85fe53b7d603945b8ac3fc998f3dcdc9281cac37

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 23:59

Target

100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
Size

357KB
MD5

100290b556fe70059997cef43b8a71ec
SHA1

20526f5f281b64e7387e07578a8237140f23a8f6
SHA256

19117a8931b01cf6f484412f85fe53b7d603945b8ac3fc998f3dcdc9281cac37
SHA512

74d2dd164b9c99e595fd8eea2a486d914307967429c8e8c006ae39216d788957aff6d10e7247a4255c91f147cdd272a9be9f4a67aba964f23565a1cde52579dc
SSDEEP

6144:b54DvCTZDx5U4MNf6NQO9XRu1YmLq8Enw1eDexz2/bAYDmb03L+nDwFLiEdjc:b5Qv6ZDjUnNfUQ681FuNnCeD8KDAsmb6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4256	servicas.bat

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\servicas.bat	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
File opened for modification	C:\Windows\servicas.bat	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
File created	C:\Windows\servicas.dll	servicas.bat
File opened for modification	C:\Windows\servicas.dll	servicas.bat
File created	C:\Windows\UNDEL.BAT	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4256	servicas.bat
4256	servicas.bat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3628	4980	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	82
PID 4980 wrote to memory of 3628	4980	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	82
PID 4980 wrote to memory of 3628	4980	100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\100290b556fe70059997cef43b8a71ec_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\UNDEL.BAT
  2⤵
  PID:3628

C:\Windows\UNDEL.BAT

Filesize
218B

MD5
eb02fc68f8967b46ad072c90178663c4

SHA1
572a86d5ce92ee43ff6c715c778896c7d0005541

SHA256
02745fcd62d9bad47aecdba71137d7a530df18a4e5650f369e3f4fcb4d9b62da

SHA512
9c14617a8f49e492e9c0ec5e8cb1cc56d11fb85255b8fbea6b89745a8871c57bc789e3f89cf94397f699bd533a27f2f5c37737472914bd0b7dc57906c10f3e06

Download Submit
C:\Windows\servicas.bat

Filesize
357KB

MD5
100290b556fe70059997cef43b8a71ec

SHA1
20526f5f281b64e7387e07578a8237140f23a8f6

SHA256
19117a8931b01cf6f484412f85fe53b7d603945b8ac3fc998f3dcdc9281cac37

SHA512
74d2dd164b9c99e595fd8eea2a486d914307967429c8e8c006ae39216d788957aff6d10e7247a4255c91f147cdd272a9be9f4a67aba964f23565a1cde52579dc

Download Submit
memory/4256-11-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/4980-0-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download
memory/4980-9-0x0000000013140000-0x000000001320D000-memory.dmp

Filesize
820KB

Download