Analysis
-
max time kernel
2s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe
-
Size
4.5MB
-
MD5
e7a4f9e822af31f6b76e99311223366f
-
SHA1
edbdefaba71e94ffeb4c467296b6dcf6f3d7f4f7
-
SHA256
71137687230ae1907a4bbed3fb4a0fa3d27dde60a37ac0347a61e94921cd225f
-
SHA512
f53bc96237f9145eb3ba7923ec3e9e1bbf2c831ef7d6d73611399456836b7fcf9f257119bb4340d1e07cc31d5d6d9c2a5e0af21b69c42bcd5d9cab2c6ed76631
-
SSDEEP
49152:EQFRHrmQG+yrY+Fr/rcrvrDRHrmQG+yr/QG+yrBrDRHrmQG+yr/QG+AQG+w:EcKUKTnKT9z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2648 inr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2648 2108 e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe 87 PID 2108 wrote to memory of 2648 2108 e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe 87 PID 2108 wrote to memory of 2648 2108 e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\inr.exeC:\Users\Admin\AppData\Local\Temp\inr.exe -run C:\Users\Admin\AppData\Local\Temp\e7a4f9e822af31f6b76e99311223366f_JaffaCakes118.exe2⤵
- Executes dropped EXE
PID:2648
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD57991a46c76675ada0f862f2b893195da
SHA17834b38a89c8b0497f6c98ced181c78d12ad0950
SHA256e830db9cc289959d3894ebdd2c3bd82225aa209b13faa3b3c3a40d88e2a9cadc
SHA5124c46b7f76925df4efad4e3f5d76ae4b4ab772ee84dbde638bbae0513cfbe0f00b656f0b3517238ffebb1c2a0d42ed5d458228090bd4017de8a417614ad56eb8b
-
Filesize
1.2MB
MD57ac27717d169f425149f8d89dc8b2681
SHA102d2476ba1a9eff6ea04400ae1f2c9521d33c9e1
SHA256810a0371f61a1834e25a3ea5da32dc9331132522c55071d4e74ea95757137abb
SHA512e8840563d76338d87b49a2933bee39057fe7cc09af0966a5a7dd3474e9aeaccdffb89d24cb2a4b61aeeac223efb3fa0dba6cd1daa8fc89e7471b76a8f03bec9d