Overview

overview

7

Static

static

3

f154e82e93...18.exe

windows7-x64

7

f154e82e93...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 14:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f154e82e931b7a4a2a3be34a4fd92abb_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    f154e82e931b7a4a2a3be34a4fd92abb

  • SHA1

    d78a452e99eb779716fb425b55fea27bb63d627b

  • SHA256

    4213f83f911916d1897dbb264b08ecc2e25fd8b31a40f2e22aa87a0bf3f398c6

  • SHA512

    8f13d39dec1e2d5fa0bf5bd2bbbfbb7cde00ce4ad1f4bacb9c0dd0a34603bff58143a384ee89f06309acb453dc184b85a552c1832a58b9ad87ae0cda324abbb0

  • SSDEEP

    49152:Qoa1taC070dbTVXyNOThLBQwzz0ZKo50eNI:Qoa1taC0g0M/

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f154e82e931b7a4a2a3be34a4fd92abb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f154e82e931b7a4a2a3be34a4fd92abb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\628A.tmp
      "C:\Users\Admin\AppData\Local\Temp\628A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f154e82e931b7a4a2a3be34a4fd92abb_JaffaCakes118.exe C62281344D71775639D0BA6F9758A4CB558DC28E454496C1A28B6069FFE9B673B2C1AE51DB4350FAD271C3D20AF9C8EC9D866D09B62E4F789D0B4F242C6F718C
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\628A.tmp
    Filesize

    1.9MB

    MD5

    4b56648e5cf535be449760851f688456

    SHA1

    04f104f6b62070ca0fe92eb9fd51e8425a144c12

    SHA256

    ca6f6983d6a6c9e1a50c21a8321f704142fdaf510847b9cd8f7a1efd37c6fe93

    SHA512

    2ea6271ab366c83145d2993c5adaea83d52e33a0f24cae706bf47afadffbbf39768bf053b9607c473ceb888258ceb82c1673b3fd91a9c0b842921f2a1cdb7cf3

    Download Submit

  • memory/748-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2276-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download