158f38fbc2c93ef0819f15889617abddacb7e11c6d8f8130df5a20180063754e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 04:13

Target

3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe
Size

180KB
MD5

3bf2cddebe3f0ff2cb3539098efac32e
SHA1

bad8f4ee98adfd160bdc4a741000e5596c772dbe
SHA256

158f38fbc2c93ef0819f15889617abddacb7e11c6d8f8130df5a20180063754e
SHA512

d6c54eb7b00063b78adf229f7b171b4a9297370ba8405790f01de53a1bcd5d9157e990e9c9e9f86b1cb1df0a55e2ed1619b48588102bb041610bf0c0cb04aa2b
SSDEEP

1536:DCqlZmQ2sKO7pnqx1syBfjEKlnMquls2iV5r5jfcLgQh7GMzvF5Zft0efoinoB7:4/sG17BfAKJalFyNbcL37F5b0ef2B

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2424	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	provie.exe

Loads dropped DLL 2 IoCs

pid	Process
2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe
2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\provie.exe	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2536	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	30
PID 2560 wrote to memory of 2536	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	30
PID 2560 wrote to memory of 2536	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	30
PID 2560 wrote to memory of 2536	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	30
PID 2560 wrote to memory of 2424	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	31
PID 2560 wrote to memory of 2424	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	31
PID 2560 wrote to memory of 2424	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	31
PID 2560 wrote to memory of 2424	2560	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2560
- C:\PROGRA~1\provie.exe
  C:\PROGRA~1\provie.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\Deleteme.bat
  2⤵
  - Deletes itself
  PID:2424

C:\Deleteme.bat

Filesize
212B

MD5
5ffedb3c9b11e1900320d9ef678535ad

SHA1
e8929c8edcbd5771a43b5db5375dc46ba46bc530

SHA256
fffbf58379df9b3f227181bac2fd9c8653e354950410365377821f988e1874e9

SHA512
adab8bbc1062bcf3980ef40c7968c4fd1c69b2a2a07289e3702e2a39810feae1f92811bf37116174546d747141af80528c1caaf640f79da3d08c7cb1669d6985

Download Submit
\PROGRA~1\provie.exe

Filesize
66KB

MD5
b957e259773fdfd36344c1e9ffbc97f4

SHA1
fd099cea23b20aed8bf9f100c7dd27a27fcd8db2

SHA256
8e612c7ddffe8e5fabb7f81d323e5519557ed67f762166f76cd2592c3a0801ba

SHA512
3de8fcaf412742a2f546b7abcc804ebab76fdead6d128a36645187c0c0dc15b72c5baaf19db7801de6d52dd866737dbaeaf9dc2243cc51228b549cc64909e253

Download Submit
memory/2536-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2536-10-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2560-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2560-9-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/2560-19-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download