2f272b624b718162e48b4cdfa61c5f7a020ec4d54b291878023b3ee2d26128f6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 18:20

Target

60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe
Size

32KB
MD5

60ebe0db55dfe3b41edd7870c2d0da8a
SHA1

78acd254cb796a675c6c2da2f964b70818b44b69
SHA256

2f272b624b718162e48b4cdfa61c5f7a020ec4d54b291878023b3ee2d26128f6
SHA512

28924ab9085643d5b749a428fe4f99cbe77563a9ce35b8762ae4a67860c6d2656e6edfbc85224405103dce3266f0f0209b71d83d9a7e8fdd760770ecf9dbbc4b
SSDEEP

384:h7vcS1D9XjqazLz7PMrzTLd965kdCSTD2dbjhrUy08wjteZGUei:hYSd9GknPMrLd961Sv2Ey/sUei

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1956	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1848	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1956	1848	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	31
PID 1848 wrote to memory of 1956	1848	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	31
PID 1848 wrote to memory of 1956	1848	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	31
PID 1848 wrote to memory of 1956	1848	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninstf76b08a.bat" "C:\Users\Admin\AppData\Local\Temp\60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe""
  2⤵
  - Deletes itself
  PID:1956

C:\Users\Admin\AppData\Local\Temp\uninstf76b08a.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/1848-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1848-4-0x0000000000401000-0x000000000040E000-memory.dmp

Filesize
52KB

Download
memory/1848-3-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1848-2-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/1848-8-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1848-9-0x0000000000401000-0x000000000040E000-memory.dmp

Filesize
52KB

Download