Overview

overview

7

Static

static

3

291e6c614b...18.exe

windows7-x64

7

291e6c614b...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 18:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    291e6c614b7b47697f7814d6170f4a1f

  • SHA1

    fc93ffcb361d79d568b4ebe411d51d30bb32fa06

  • SHA256

    8a68f6fd7102c400d1ec1af36a677e71eef85cb0984d938208d3abe40308b17e

  • SHA512

    315b5eb1b72661aa12b1b2d9f777365c6d4c10cf49a8a31293227fba0c87d486fd5ba8f173e9fdc48098b83fa3fd8c8d81d4888eaafbf4a8fb44bbe3be6a7174

  • SSDEEP

    49152:Qoa1taC070dT9mGl17s1eQhsiMqcGU57XL8iOM:Qoa1taC0Qs1eQhdovOM

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\C236.tmp
      "C:\Users\Admin\AppData\Local\Temp\C236.tmp" --splashC:\Users\Admin\AppData\Local\Temp\291e6c614b7b47697f7814d6170f4a1f_JaffaCakes118.exe 9B4CDD659B8FE0282197222AA2B24DB1F63ACEB97854B4271285E1A36514CFFBBDB1A58FD6576341F34C27E8909F32798C855431C6E55209581414B56BBC017D
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3036

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\C236.tmp
          Filesize

          1.9MB

          MD5

          a37a929e3152b385660cbf2ba54d3847

          SHA1

          b639eed8ec4c3cc584574ae12012041e8b02a388

          SHA256

          6267eefa282f8e98f3f437f475ff025811145af531bc2d6051ea419715434633

          SHA512

          b9868d9b8f0cc2451dd46abe476dffdd5bffb9c17d449755643c284a0eb87a0b1a6d295f6f9398efb4cac324af932e0780d99eaa9932267ddffdb942fa3ee224

          Download Submit

        • memory/2888-0-0x0000000000400000-0x00000000005E6000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3036-6-0x0000000000400000-0x00000000005E6000-memory.dmp

          Filesize

          1.9MB

          Download