Overview

overview

7

Static

static

1

0632ff3aea...18.exe

windows7-x64

7

0632ff3aea...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 22:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    0632ff3aea9bd337396351690ac1d861

  • SHA1

    fdf7405296418b002b64d8ba85ecec0bc7d9edc1

  • SHA256

    2440d0913a69419211c57ce2051419ed9979b3414b21ef16ac9f0b22fafdf88e

  • SHA512

    61704f88f2c09224a62c8a380538edf9e1a2f88bfe9b8954ae2cc20eded56c1aa07a51a437d872ba437a2bcda11607124cc7a5490cb73af03e9213376f31ccbb

  • SSDEEP

    49152:h9bwaU13IMC6zpnr4lvb91zRUF1RSoeofXjx24knf94+/b/:faoPlv51NK0oe+Xjxmi+/b/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\is-RF3CL.tmp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RF3CL.tmp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp" /SL5="$30148,1854971,52736,C:\Users\Admin\AppData\Local\Temp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-6TAVH.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-RF3CL.tmp\0632ff3aea9bd337396351690ac1d861_JaffaCakes118.tmp
    Filesize

    689KB

    MD5

    39aac789079975156ed2ef01b2cf3731

    SHA1

    430d1e284a263a6ba4cd55dffcdac6e6021b57db

    SHA256

    4f6f834ca1d1e3f198c87c76f75b882c8f238cb30a8bf1760e255ad27f5fb8d1

    SHA512

    3f1e772539ad79ae7380afd8e336b7a991b033878fac06ad3879b6d09d9a3631c4d8348ca0c2481d3a42fc20eed02bd431631ab4b789e3862bf96e574d30e328

    Download Submit

  • memory/1956-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

    Download

  • memory/1956-1-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

    Download

  • memory/1956-16-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

    Download

  • memory/2132-13-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2132-14-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

    Download