7c9a002a03135fc3f40d20900ec57c7edc860ecc5b1f35606a3d73ca0cbb0e88

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe
Size

363KB
MD5

3b724573d6e75ed2112bfce00d268956
SHA1

81c129ea5faa70c35cfa5981e1492276220e077c
SHA256

7c9a002a03135fc3f40d20900ec57c7edc860ecc5b1f35606a3d73ca0cbb0e88
SHA512

670a3d6f78ca4ee92a2a7c34dbdc80be85835ef3a283c886ec74f6c445434b74373f52835221b2bbffe078d8296c3b6a32ab806286d821c5cccdc2200dfeaaf6
SSDEEP

6144:NkKx5bJWmAPc3KF6MCpj95tnCEeDDAEXaTr4JiDtqFNvpl5MUzbTI6Wh2yK96q:NrX9W7k3fMCt9jCT/PKTkJitqPdtzbTH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
2160	MpSigStub.exe
2160	MpSigStub.exe
2160	MpSigStub.exe
2160	MpSigStub.exe
2160	MpSigStub.exe
2160	MpSigStub.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File created	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2160	2844	3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe	28
PID 2844 wrote to memory of 2160	2844	3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe	28
PID 2844 wrote to memory of 2160	2844	3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\MpSigStub.exe
  MpSigStub.exe /program "C:\Users\Admin\AppData\Local\Temp\3b724573d6e75ed2112bfce00d268956_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\6710072FC9518374AA1405905FEC2CF2-Sigs\1.201.486.0_TO_1.201.530.0_MPASDLTA.VDM._P

Filesize
59KB

MD5
8b73e9968fb661fe0d48db5fb68ddf96

SHA1
6b60b6c7d76b4e05c53d0e1b12767160080ae6b5

SHA256
4810f733b210aad2b48ac2ebc928fdc8363c68ab5a49c7b1ff3955391b6252ec

SHA512
8b96ac58bc766cb62d3f4856027756441be492d42a394654ff513246c62d1b9be465676642973346f72e327e32f8109e71d2b20547fdef1446653d08aece61fe

Download Submit
C:\Windows\Temp\6710072FC9518374AA1405905FEC2CF2-Sigs\1.201.486.0_TO_1.201.530.0_MPAVDLTA.VDM._P

Filesize
271KB

MD5
438f17bee6882e272389ee78fc04efad

SHA1
2cee40c9ab97d993f2127091cb39823a867a0f8f

SHA256
d25b383d305fb92c15c49aabd63be28a7bfaea30f73062b4266238c1ee256dc5

SHA512
594f31147207fcdbe8668057ffb9bc809025bbe7edac02f6b929ff9f81da7d921dd70a512a0aedd5576c6585ec5ef829a74e86fb6ab1f6e7d2a2b30763ceb362

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm

Filesize
11.1MB

MD5
b17051cea6ecf263ef7eb4b79fa50763

SHA1
ad15f2f519b32ffce10e23e6ee6436b0d49136e0

SHA256
f10a3dbeaba655f7f595c8954cb85d5e7804a2cdcf6a09c0544eeb739d442dfa

SHA512
f904c88765b9dea30a2276ac988dbc7daa2ca19c879983ab03fa4c7665eec987644ec8734711b7d02597e3b4af8b2625a54930f7afb5ad095c966bef3c087475

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm

Filesize
331KB

MD5
f0f8b583c084699ddbf036b892058f6e

SHA1
3d7b233ea117b55b3708d29fda451d39313ff27a

SHA256
d2ca676148c1f59c2d3494bb0aa28127d2957ea8c2f494ddebe7e1249038e9a1

SHA512
383a8cdf759e7b4395e0e295700db316c8d06c8589333f22ddc29efdf350c66f5fd8b729f95a0e2a1b3a0798f8af0b06a9bb4971a300039d9baea6101d233697

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpengine.dll

Filesize
7.8MB

MD5
97bdc9a400eef273cc4b336614ca74bd

SHA1
b0c55c5f48ec0f32bcac631005755c722913e21c

SHA256
2b0792816c882c8b7dafe93e8148df94b1c0786287272e3fe4005166751069ae

SHA512
7dbe3c6b11ed5997d78bc4982f5b485ad61cc779add961899922a62df8b010dd3481a6236d631c9557816e84de8e4b16d8b66362b04ec6becb16fe85b8169e86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads