af08a95e171ebbe32fd881bcc9947547db0fe2b011b267d385103b00bda92621

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe
Size

2.1MB
MD5

5ebe7c035547f63af6fb3acc35b113fb
SHA1

875919555adfe69e86457cb89289e55f70c148a2
SHA256

af08a95e171ebbe32fd881bcc9947547db0fe2b011b267d385103b00bda92621
SHA512

f6171f68a7fad1f3dddc8b2b50f259ae0fd124f1a83156e595270b0f0aaf1b9d215ea040057076961175882b5e6283fc02fe0d2ebba8bfbb29353f1847001de3
SSDEEP

49152:uR6CJd18MJHH+Ovfc9jja/BnFLyPYcMB8KhtrQTUonjhb455JbQ8bher:FCJdyMtH+ScmVyP/MeMrQTPY1Q81er

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
2928	MpSigStub.exe
2928	MpSigStub.exe
2928	MpSigStub.exe
2928	MpSigStub.exe
2928	MpSigStub.exe
2928	MpSigStub.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File created	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2928	2868	5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2928	2868	5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2928	2868	5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\MpSigStub.exe
  MpSigStub.exe /program "C:\Users\Admin\AppData\Local\Temp\5ebe7c035547f63af6fb3acc35b113fb_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\60CC431178966A143BBC326CE3554D80-Sigs\1.199.3207.0_TO_1.199.3265.0_MPASDLTA.VDM._P

Filesize
948KB

MD5
7510a6d6a19ff85723260caed9fa3514

SHA1
b4bdd12ef68ffbd08f3a350e6726d6562459b3ea

SHA256
47780cb7b5e7d43684ac57e2b8b97994e9f250c32e9954e9f7be94af0670c9a2

SHA512
76141780e8f49fd381d0202650717e88b6c6f240cf140cfb0ee9876b04ed19be887456e8dc8836881e364a21199e91216db43e36a5e9ed20e63c28b829b140a8

Download Submit
C:\Windows\Temp\60CC431178966A143BBC326CE3554D80-Sigs\1.199.3207.0_TO_1.199.3265.0_MPAVDLTA.VDM._P

Filesize
1.1MB

MD5
ec0a4857831ea9d68de9e562c7ce38d7

SHA1
2ddbaa190213e41271e31a1b45f8f55cff158a33

SHA256
3af26fccd4dcf4122404d5b2670d88b15c07947294cbd42de66436e602972b26

SHA512
8eaa4445e72ef0b976a1870eb663b083ccca8ae480ad9788bd21eb1904126fdbd5126b230aeaaa4b9fc04475fc75b00c36f5b6243764e85584961aaf41efb3e0

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm

Filesize
11.1MB

MD5
b17051cea6ecf263ef7eb4b79fa50763

SHA1
ad15f2f519b32ffce10e23e6ee6436b0d49136e0

SHA256
f10a3dbeaba655f7f595c8954cb85d5e7804a2cdcf6a09c0544eeb739d442dfa

SHA512
f904c88765b9dea30a2276ac988dbc7daa2ca19c879983ab03fa4c7665eec987644ec8734711b7d02597e3b4af8b2625a54930f7afb5ad095c966bef3c087475

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm

Filesize
331KB

MD5
f0f8b583c084699ddbf036b892058f6e

SHA1
3d7b233ea117b55b3708d29fda451d39313ff27a

SHA256
d2ca676148c1f59c2d3494bb0aa28127d2957ea8c2f494ddebe7e1249038e9a1

SHA512
383a8cdf759e7b4395e0e295700db316c8d06c8589333f22ddc29efdf350c66f5fd8b729f95a0e2a1b3a0798f8af0b06a9bb4971a300039d9baea6101d233697

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpengine.dll

Filesize
7.8MB

MD5
97bdc9a400eef273cc4b336614ca74bd

SHA1
b0c55c5f48ec0f32bcac631005755c722913e21c

SHA256
2b0792816c882c8b7dafe93e8148df94b1c0786287272e3fe4005166751069ae

SHA512
7dbe3c6b11ed5997d78bc4982f5b485ad61cc779add961899922a62df8b010dd3481a6236d631c9557816e84de8e4b16d8b66362b04ec6becb16fe85b8169e86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads