239789c9f280ac4e5f71b9798842175f097fa0e759a5d63e8f225ea327a426ce

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe
Size

2.5MB
MD5

0ec1c0203d6c81c6d1eb6b20876c6049
SHA1

9213e4327340567b1efb6ff59b80f296217cde0c
SHA256

239789c9f280ac4e5f71b9798842175f097fa0e759a5d63e8f225ea327a426ce
SHA512

a43df7f193274dca632a6b6d98ed0ece0fb997aa2ce85704e05066f6b4e293b1be2204b3af55818c6ddc6fa6f6d9db7224f8451031e97503affe3cd369a03e7f
SSDEEP

49152:EnJkzj/1zWKrVkM7l++kWdO0zrtWOmntmKS6OpNRL40PSPFn:6JcKKrVF2Wwwrttm0KhOpNN40P0F

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
2316	MpSigStub.exe
2316	MpSigStub.exe
2316	MpSigStub.exe
2316	MpSigStub.exe
2316	MpSigStub.exe
2316	MpSigStub.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File created	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2316	1632	0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe	28
PID 1632 wrote to memory of 2316	1632	0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe	28
PID 1632 wrote to memory of 2316	1632	0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\MpSigStub.exe
  MpSigStub.exe /program "C:\Users\Admin\AppData\Local\Temp\0ec1c0203d6c81c6d1eb6b20876c6049_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\935188A6FE33BDD418771569E1F0F393-Sigs\1.201.1302.0_TO_1.201.1376.0_MPASDLTA.VDM._P

Filesize
1010KB

MD5
9394a25fe601f0fa0d11fd5b963e7c34

SHA1
a62f2c64e62a4b964ffff521248fe4508353e459

SHA256
9a810ba5fa8ae07cf753fa960db2495d94609af5a171b19e301764e42411732d

SHA512
50b4abcaad62866c375e6eb7949c3d6cb42a87ced3800cff98d3b411fa9554bec3b35c4b5cd2499d82243163245c5ddb905255f41aff58f1c22d96c3195c3174

Download Submit
C:\Windows\Temp\935188A6FE33BDD418771569E1F0F393-Sigs\1.201.1302.0_TO_1.201.1376.0_MPAVDLTA.VDM._P

Filesize
1.5MB

MD5
ecf52327eb74119ec29cace4ee9f4489

SHA1
ed28c0ce5b9a7e90e61a43c001b68d0f25408e56

SHA256
a7f5e50a71e273539a9a684012e2a2beefd288fef0da44287bd96529163f6c50

SHA512
a5bd1c93fd5d9bfe0a16573f8ba3b9626e8bdbff0c4ce66ee0ece999ee73774bfa39ada832304982198f8f0f6d7dc5277cbde5692d83cde23e6c14a5d0d8233a

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm

Filesize
11.1MB

MD5
b17051cea6ecf263ef7eb4b79fa50763

SHA1
ad15f2f519b32ffce10e23e6ee6436b0d49136e0

SHA256
f10a3dbeaba655f7f595c8954cb85d5e7804a2cdcf6a09c0544eeb739d442dfa

SHA512
f904c88765b9dea30a2276ac988dbc7daa2ca19c879983ab03fa4c7665eec987644ec8734711b7d02597e3b4af8b2625a54930f7afb5ad095c966bef3c087475

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm

Filesize
331KB

MD5
f0f8b583c084699ddbf036b892058f6e

SHA1
3d7b233ea117b55b3708d29fda451d39313ff27a

SHA256
d2ca676148c1f59c2d3494bb0aa28127d2957ea8c2f494ddebe7e1249038e9a1

SHA512
383a8cdf759e7b4395e0e295700db316c8d06c8589333f22ddc29efdf350c66f5fd8b729f95a0e2a1b3a0798f8af0b06a9bb4971a300039d9baea6101d233697

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpengine.dll

Filesize
7.8MB

MD5
97bdc9a400eef273cc4b336614ca74bd

SHA1
b0c55c5f48ec0f32bcac631005755c722913e21c

SHA256
2b0792816c882c8b7dafe93e8148df94b1c0786287272e3fe4005166751069ae

SHA512
7dbe3c6b11ed5997d78bc4982f5b485ad61cc779add961899922a62df8b010dd3481a6236d631c9557816e84de8e4b16d8b66362b04ec6becb16fe85b8169e86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads