Overview

overview

7

Static

static

3

ff6f88e1c5...18.exe

windows7-x64

7

ff6f88e1c5...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/04/2024, 13:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff6f88e1c58f5d69b4db83b5502e144b_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    ff6f88e1c58f5d69b4db83b5502e144b

  • SHA1

    76bd47b56d68128fe882bd3b8c81fcfc8eb38e12

  • SHA256

    0ee6a8a31a41e2d9dae7c8b3ef29c13ec61a3348db279c50255dd3129ee6968b

  • SHA512

    7d6cc8386b719722727e5504be5f78265672f2bb994abfc18a0fc01803bc1a2d5962f82144537e6f4d2719e9e48f2a222ff2d73577e43b57d5532e409aceb613

  • SSDEEP

    24576:N2oo60HPdt+1CRiY2eOBvcj3u10dtr1eKihbOlVntMnMiL5J7nUUJbMKZBQjCMXV:Qoa1taC070dtJniheVkM4Ru2Ml

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff6f88e1c58f5d69b4db83b5502e144b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff6f88e1c58f5d69b4db83b5502e144b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\20AA.tmp
      "C:\Users\Admin\AppData\Local\Temp\20AA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ff6f88e1c58f5d69b4db83b5502e144b_JaffaCakes118.exe 2264C9DF1F8B086C18C3A03B6C021FDE30117D2DCF8A503FA9DC44AE85A607F85DA696C137557E8CA6B2A2877BECB03AAA380A4E5FFD89C2E9B168E41EA4C3DB
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\20AA.tmp
    Filesize

    1.9MB

    MD5

    b56c2eec7c12107659f0a3c7ff65b43c

    SHA1

    2c1f38a0f99be9205d474b70373b99a6a9df146d

    SHA256

    94399cbbf471c47bc10dec36715e464357df65f735d99a1832e791b5caa563b3

    SHA512

    99e2f03f7d7165aa1418531ebe1d47d1fca7b3184b5fd731c79fe5d6497ef2ec47ba9b52d904086b4bc01d07c88f0835a87401864dce005315b035991b37ef31

    Download Submit

  • memory/1684-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1820-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download