158f38fbc2c93ef0819f15889617abddacb7e11c6d8f8130df5a20180063754e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:13

Target

3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe
Size

180KB
MD5

3bf2cddebe3f0ff2cb3539098efac32e
SHA1

bad8f4ee98adfd160bdc4a741000e5596c772dbe
SHA256

158f38fbc2c93ef0819f15889617abddacb7e11c6d8f8130df5a20180063754e
SHA512

d6c54eb7b00063b78adf229f7b171b4a9297370ba8405790f01de53a1bcd5d9157e990e9c9e9f86b1cb1df0a55e2ed1619b48588102bb041610bf0c0cb04aa2b
SSDEEP

1536:DCqlZmQ2sKO7pnqx1syBfjEKlnMquls2iV5r5jfcLgQh7GMzvF5Zft0efoinoB7:4/sG17BfAKJalFyNbcL37F5b0ef2B

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1760	provie.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\provie.exe	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1760	1832	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	83
PID 1832 wrote to memory of 1760	1832	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	83
PID 1832 wrote to memory of 1760	1832	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	83
PID 1832 wrote to memory of 2508	1832	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	84
PID 1832 wrote to memory of 2508	1832	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	84
PID 1832 wrote to memory of 2508	1832	3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bf2cddebe3f0ff2cb3539098efac32e_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1832
- C:\PROGRA~1\provie.exe
  C:\PROGRA~1\provie.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\Deleteme.bat
  2⤵
  PID:2508

C:\Program Files\provie.exe

Filesize
66KB

MD5
b957e259773fdfd36344c1e9ffbc97f4

SHA1
fd099cea23b20aed8bf9f100c7dd27a27fcd8db2

SHA256
8e612c7ddffe8e5fabb7f81d323e5519557ed67f762166f76cd2592c3a0801ba

SHA512
3de8fcaf412742a2f546b7abcc804ebab76fdead6d128a36645187c0c0dc15b72c5baaf19db7801de6d52dd866737dbaeaf9dc2243cc51228b549cc64909e253

Download Submit
\??\c:\Deleteme.bat

Filesize
212B

MD5
5ffedb3c9b11e1900320d9ef678535ad

SHA1
e8929c8edcbd5771a43b5db5375dc46ba46bc530

SHA256
fffbf58379df9b3f227181bac2fd9c8653e354950410365377821f988e1874e9

SHA512
adab8bbc1062bcf3980ef40c7968c4fd1c69b2a2a07289e3702e2a39810feae1f92811bf37116174546d747141af80528c1caaf640f79da3d08c7cb1669d6985

Download Submit
memory/1760-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1760-6-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1832-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1832-9-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download