3087fff294c170273a8fb28f381bfedde7b0c4f3582273d695cfbd01c8b39f6e

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 00:54

Target

3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
Size

1.4MB
MD5

3f9013234dc04066a5bf01983c81cdeb
SHA1

8631ae1d49ac4ebc80809950c0d0091061f35040
SHA256

3087fff294c170273a8fb28f381bfedde7b0c4f3582273d695cfbd01c8b39f6e
SHA512

c5f63a9483986577556d8c88060e8822d9e45eee033b96fd67f2fbc0d1eef7f1189e2b4f56e5f9ed784c0285c2dcfddc11e3c2835ecc5929520de3a51202ee42
SSDEEP

24576:v3E4DccxcHHFnlDJCnB9VDt3g19zfqNgYGVDFsM1wNmTPXYuvYVr8+6Wrps:/wPlnl4nTphgr2uY6DjwcPXFvYVr83

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2952	y409838.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\winhelq.ini	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File created	C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\y409838.EXE	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.ini	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\winhelq.ini	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\y409838.EXE	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File created	C:\Windows\3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.Pah	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2952	1288	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe	85
PID 1288 wrote to memory of 2952	1288	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe	85
PID 1288 wrote to memory of 2952	1288	3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f9013234dc04066a5bf01983c81cdeb_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1288
- \??\c:\windows\downloaded program files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\y409838.exe
  "c:\windows\downloaded program files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\y409838.exe"
  2⤵
  - Executes dropped EXE
  PID:2952

C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\y409838.EXE

Filesize
9.7MB

MD5
0520b9cf283e6656d1a8720492ed32e5

SHA1
9cab365784159ab6951e01b642770d798a00ded1

SHA256
f9961456b6035359f047dd84ea47f83ae2876c5b39fc9b0f24f79521a03ae0d9

SHA512
545cd5ee7dfbfaf9ba4f566dd3541898bb62cc876869ef3b72a95c5e997e3210e7b19b9b83efccfd34a924e62b6c35e10720807bd7ef663a87a06bd924d72cf0

Download Submit
C:\Windows\Downloaded Program Files\ÿ¡¡¯Á¯Æÿ\¯Á¯Æ\y409838.EXE

Filesize
9.7MB

MD5
ccf7d8a3290e496a8331ca1658987098

SHA1
9dc5e257c40e0e2b587b3b273557ab6e6d836b04

SHA256
6ce4c12a8ec8de0efed6786780a2dda77f7b606f35de1d26c6987c3249ac9707

SHA512
13e78a1fc16c69665d3b118f6ab1dc85372b140ac1576ab45d980bb12c98ece29ecaa0a48d7614b704a211723e9df7fe0a139bab48e6ccdd390e992f6d646bf2

Download Submit
memory/1288-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1288-1-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1288-22-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download