9bddc4ff3c761d69ed89a84e9dc3f030dde89a1e3ae0ddb0acf462221a471c17

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 15:56

Target

2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
Size

77KB
MD5

2cee99afe64a27497625531e8002011d
SHA1

9c9164ab4d87c1ad72ca4e4421df3bf87a01c250
SHA256

9bddc4ff3c761d69ed89a84e9dc3f030dde89a1e3ae0ddb0acf462221a471c17
SHA512

be9726166743a4d6e64cb0198d54df634127059874f6ec285d355d0f4183b61b6870621f5002f871e61b077e8a62fcab3ea342b316c2d696fe89f44782628bb4
SSDEEP

768:giSqdQOJUDkXoOg8qaSJOUQ9v4G9CBXSQmiLdcw1AEZz0rZmJsjm/lg/16AS:nSqdQOJTYOXqPQ9v4JRLbWGzQxUgto

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1636	NTdhcp.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NTdhcp.exe	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NTdhcp.exe	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NTdhcp.exe	NTdhcp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Deleteme.bat	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1636	520	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	91
PID 520 wrote to memory of 1636	520	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	91
PID 520 wrote to memory of 1636	520	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	91
PID 520 wrote to memory of 264	520	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	92
PID 520 wrote to memory of 264	520	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	92
PID 520 wrote to memory of 264	520	2cee99afe64a27497625531e8002011d_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\2cee99afe64a27497625531e8002011d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cee99afe64a27497625531e8002011d_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\NTdhcp.exe
  C:\Windows\system32\NTdhcp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Deleteme.bat
  2⤵
  PID:264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4232,i,5095735526234624271,6356691058050835509,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
1⤵
PID:3868

C:\Windows\Deleteme.bat

Filesize
212B

MD5
185e979243e1c67bbdebd7b453ab3ac6

SHA1
2492065831a174fbc13d79ea502cdb45b73964af

SHA256
80969538533203d341448df6b6ca873b9bac2548a80a2660732891891fa7177b

SHA512
de4117bb3be6646d736ca61232fd4e301e7928923657d00d2bb4b508f8d9ae8eafb939b658eb7f54d46723809ff27a7096a60575ef9bbd4cbddad11eb760c1f2

Download Submit
C:\Windows\SysWOW64\NTdhcp.exe

Filesize
77KB

MD5
2cee99afe64a27497625531e8002011d

SHA1
9c9164ab4d87c1ad72ca4e4421df3bf87a01c250

SHA256
9bddc4ff3c761d69ed89a84e9dc3f030dde89a1e3ae0ddb0acf462221a471c17

SHA512
be9726166743a4d6e64cb0198d54df634127059874f6ec285d355d0f4183b61b6870621f5002f871e61b077e8a62fcab3ea342b316c2d696fe89f44782628bb4

Download Submit
memory/520-0-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/520-10-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/1636-6-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/1636-9-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download