1cede1cb3b854c3623f5cd20b60575355be7b885c58a6d7f5da14e61de0ca733

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 05:07

Target

3c15369e272190582280b987db030d5c_JaffaCakes118.exe
Size

66KB
MD5

3c15369e272190582280b987db030d5c
SHA1

7ce52289dda7ce04fa076d6d304237585b6eda05
SHA256

1cede1cb3b854c3623f5cd20b60575355be7b885c58a6d7f5da14e61de0ca733
SHA512

e3ed86527bf15ce4692208a1e0f7b601ce4125571d0e002eae78646aa002032125e5f8d7d5d319e03b90b065bda76e00e6c4e7b9427c4426611cea577fa9b83c
SSDEEP

1536:ibx6sLU7cZMX1hrPuihzun6mLksGRXrDWY4:iN6WUQZGhrPVCtU314

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\zbiddmrcup9.sys	3c15369e272190582280b987db030d5c_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1644	2004	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	83
PID 2004 wrote to memory of 1644	2004	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	83
PID 2004 wrote to memory of 1644	2004	3c15369e272190582280b987db030d5c_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3c15369e272190582280b987db030d5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c15369e272190582280b987db030d5c_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\rreiakhbmbnf.bat
  2⤵
  PID:1644

C:\Users\Admin\AppData\Local\Temp\rreiakhbmbnf.bat

Filesize
260B

MD5
5f3d79a11f3937167682960717178ce5

SHA1
bad909dcb898d472c1626201b1bf71e2805cb397

SHA256
fcda6998da24f4f1d6fe1f2bf1879782814ca0afc6e5b233e2fae8172ab10705

SHA512
7f9564ae9bb4a61286135a454631c0aaa4e0f5885a49ef3d184c3b0374a2c615bb52b9f3a43171bbc62e431b7b405176d7477162233fed5e9ee195179db17ff2

Download Submit
memory/2004-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2004-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download