Overview

overview

7

Static

static

3

033e840c32...18.exe

windows7-x64

7

033e840c32...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2024 10:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    033e840c32827abc3bcfb79541186375_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    033e840c32827abc3bcfb79541186375

  • SHA1

    583c51f19df7e29e7ab073e72e1905e39b517fac

  • SHA256

    5e321be2999b0d11bd0158684de3cf44296e90347b4a1e0755247427870efaa6

  • SHA512

    852325d295b6a1fd08a84cf06d4512787f30bd29060a1a6801dea4177bacab107df22b47b0522e9cdfbafffbf8d4fc5eac9679226016c577207c72498adefd99

  • SSDEEP

    49152:Qoa1taC070dEUnax3z6Hj1aZFz/pcNMlb4E8WmkE3Px:Qoa1taC00nL0DzhcmvmkE35

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\033e840c32827abc3bcfb79541186375_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\033e840c32827abc3bcfb79541186375_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\1FA1.tmp
      "C:\Users\Admin\AppData\Local\Temp\1FA1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\033e840c32827abc3bcfb79541186375_JaffaCakes118.exe 0C60E5F614CC9EF177269BC0F80D782C1B106E9104CA048B5F7720906A100427AB23D3A389159DE7DB67CE34D8CE0E1B05BC06DF1A2EF9B1ACF758B608A7296B
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1FA1.tmp
    Filesize

    1.9MB

    MD5

    55e6d9f24cb906b920060d4b57b5cb23

    SHA1

    95d2996ba17bb418b38115d883f3f250419e8a8d

    SHA256

    c5e6b69bfaf566811eec8409e56974da1bd953e59136d32d485b0fb849421bdc

    SHA512

    f27a8d716b940c5b606372faffb517f3b0b6b83505e6ac910df0286962e6041a71a0dc6902edbe64e309b98682cf43acaf8338b54ad81fb5a300ede9511fde02

    Download Submit

  • memory/2000-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2948-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download