Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
28/03/2024, 16:29
General
-
Target
0a818560cb8563707d8822fb1b666228_JaffaCakes118.exe
-
Size
816KB
-
MD5
0a818560cb8563707d8822fb1b666228
-
SHA1
e34a57bacae8d63b641df3ae240ecab113c79688
-
SHA256
f9fc04efb5601512fe26b7176efb816427b2ec5bdfc0bc89fe488405ec922d2c
-
SHA512
75726f4a212087c49b4a845b7a31b28a6790e41422d9ea8871c149b1787386a1151ab8ec3e8c1fc16c7c614eed3b659d3e283418a04bbdbde819e125df9a220d
-
SSDEEP
24576:xY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9/:u3XZynV4oDabuWbDQOcIxJJ9/
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a818560cb8563707d8822fb1b666228_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a818560cb8563707d8822fb1b666228_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1D0E0B0E120A156A155A15C0D0A160E0C160A.exeC:\Users\Admin\AppData\Local\Temp\1D0E0B0E120A156A155A15C0D0A160E0C160A.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD57a979bdea8a906cd28b79bbadb8cdc17
SHA1e796ae5783d8829f16d5813b576cc8d82f068a76
SHA256510812a1a478450117a976fd82aefb78643398545ddca833a4c97ed0699c5db5
SHA512abc4f5441f228861647054bb65ed0e1845b6229a26c268312fb0e098500a135fae26609a5e1220b286e53237e28e7441d6d3a6b3dec7789662053e3168a59b68
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB