c952f7847e3506767527d442a29859b4bf6a85497e41695d20f563369055eccc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
Size

1.3MB
MD5

68d4998a4d43e5e8a17824ae9625d50e
SHA1

585e37a0cf5325b293a85d9e982d305e017387f3
SHA256

c952f7847e3506767527d442a29859b4bf6a85497e41695d20f563369055eccc
SHA512

33d61632b624c6f602e3dd88e403f55bb5b924f09a1e5014a9fa52138d82dde2f995dd4caf619f307ebf2b761f5342e28ea2bc33dbebd37b47745b05e09edec3
SSDEEP

24576:zAHnh+eWsN3skA4RV1Hom2KXMmHasyAkapHeoC0TLc3DbEJ5:+h+ZkldoPK8Yaseb2

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CloudNotifications.url	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2120	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2120	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2120	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2120	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2068	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2068	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2068	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2068	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2868	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2868	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2868	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2868	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2876	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2876	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2876	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2876	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2888	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2888	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2888	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2888	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2924	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2924	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2924	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2924	2180	68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
  2⤵
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
  2⤵
  PID:2068
- C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
  2⤵
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
  2⤵
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d4998a4d43e5e8a17824ae9625d50e_JaffaCakes118.exe"
  2⤵
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads