Overview

overview

7

Static

static

3

d0121aafc7...18.exe

windows7-x64

7

d0121aafc7...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 09:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    d0121aafc70d2e972ee1d23b3460a856

  • SHA1

    2d2015fae69a934832da394d27e93366d5a68b67

  • SHA256

    36417a157ba50103b551c55c44377105455f7d3f76add8d0ffe3859ae32bfe64

  • SHA512

    d9f7adedecba0c92adc1fd0f36627edb313bc4bf3031c9555e3541fb47d945ae4eaf000ed7f3894a0adda5bb37548c6cfda5d5ea3b3d23c2737d4824f44cf3b2

  • SSDEEP

    49152:Qoa1taC070dpTubkoDGaXoJgPCzB6J2KZ:Qoa1taC0kfMsu

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\4422.tmp
      "C:\Users\Admin\AppData\Local\Temp\4422.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d0121aafc70d2e972ee1d23b3460a856_JaffaCakes118.exe 879FDB384AF36DC5C97F0B19FADDD8DBC1DA4AFD5CB35114F8F7DEFCFB228A24C754F1A9466039328874E5CC9E29CD7C1DE7C3DF71E18611387F7A5DC43DBD72
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\4422.tmp
    Filesize

    1.9MB

    MD5

    8f2014904ea77b76a1a0cfa5d7af89db

    SHA1

    c8707435aee3482d2e02b685f3076340f7c84fc9

    SHA256

    578e8d9bd21203b7d55046960758f2048643798938f55c633133c29ecc9e1855

    SHA512

    b7a37c617a9193edd5f4a3dbf47ea8e764d39eb8612d83106a7941d9569a92d3abbc41898a8f5b21fd81429c558f1bc6798176837cdfdec1e42877cce1bf096a

    Download Submit

  • memory/1408-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2160-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download