06b40b43e49782e5338f59ff09e4b35857f6397fb443c15ac7fc4836b05cc8e0

Analysis

max time kernel
141s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe
Size

1.7MB
MD5

00bc00c172315d2be7b12ff9e852bd09
SHA1

0a76af7d72af539b8f0fe9d20cfbe90f7a6a6e60
SHA256

06b40b43e49782e5338f59ff09e4b35857f6397fb443c15ac7fc4836b05cc8e0
SHA512

c5dd266d0beeb1425edeba9ea778a3b4efbd0ca76fcf9529596ad57d5e808bb3e459cb2aee4df815c3506a9d67a309d45b0ebac4e47b2a4cef351465f0efd940
SSDEEP

49152:DYCC2brnCmsLTz2a8Y3CdMX0iPDmhIfeu6Sq0GJyFav:TfnDs7u+IMXZSyrhvGJycv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp

Loads dropped DLL 5 IoCs

pid	Process
4092	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp
4092	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp
4092	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp
4092	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp
4092	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4092	3608	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe	82
PID 3608 wrote to memory of 4092	3608	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe	82
PID 3608 wrote to memory of 4092	3608	00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\is-JJQ3B.tmp\00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JJQ3B.tmp\00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp" /SL5="$F002E,1335443,121344,C:\Users\Admin\AppData\Local\Temp\00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-3AJS5.tmp\OqIEFuprtaC.dll

Filesize
1.0MB

MD5
16090d48f4c90ffc959e878e7e697cbd

SHA1
dba2748e05b8b2c1f7d8fd7f9c677764a3365946

SHA256
e61ea546a518289762cb8ba240863f5c8f82b9c8de5d44281d1af3bc6c1104c6

SHA512
5679ecbf8fbb795660f225f5712aa16a6e26a34615cb7eb04e5a6ba1165fd10a775d9ae09871f83e2fb8f1628320187cb56ad62be6a4a8b8aae9227845375403

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3AJS5.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3AJS5.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JJQ3B.tmp\00bc00c172315d2be7b12ff9e852bd09_JaffaCakes118.tmp

Filesize
1.1MB

MD5
34acc2bdb45a9c436181426828c4cb49

SHA1
5adaa1ac822e6128b8d4b59a54d19901880452ae

SHA256
9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

SHA512
134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

Download Submit
memory/3608-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3608-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3608-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4092-13-0x0000000005340000-0x000000000537C000-memory.dmp

Filesize
240KB

Download
memory/4092-22-0x0000000007980000-0x0000000007A8E000-memory.dmp

Filesize
1.1MB

Download
memory/4092-6-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/4092-26-0x0000000005340000-0x000000000537C000-memory.dmp

Filesize
240KB

Download
memory/4092-27-0x0000000007980000-0x0000000007A8E000-memory.dmp

Filesize
1.1MB

Download
memory/4092-25-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4092-32-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/4092-34-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4092-35-0x0000000005340000-0x000000000537C000-memory.dmp

Filesize
240KB

Download
memory/4092-38-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4092-39-0x0000000005340000-0x000000000537C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads