Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:01
Static task
static1
Behavioral task
behavioral1
Sample
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe
-
Size
10.8MB
-
MD5
65c95191a911dde3bac6e9b5eb4668b2
-
SHA1
4f0851bb74445250579465f08d804a67762a37cf
-
SHA256
a9a62dd6afcd861abb1ae8d5f96f161a8b94657e77be2ff353432f640f5a8379
-
SHA512
cea3328fbc9d3e5ce891078d1b6f10f3a9e34a6d33f2dc4ebe72118d998c9891ac74ef9aae37e7bba84a2a47b4dde18e71ce9d514cbc8d8cb9afd7dd4bf36b4e
-
SSDEEP
196608:Ckmz4REjL1ydGYZ4rd+8sMiQjjSCpALfY/VwA1MhdvWgFn:kzYEjLnR1sMi+pAY/VwPWgl
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmppid process 2368 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp -
Loads dropped DLL 2 IoCs
Processes:
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmppid process 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 2368 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmppid process 2368 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exedescription pid process target process PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp PID 2868 wrote to memory of 2368 2868 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe 65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\is-3KUIU.tmp\65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-3KUIU.tmp\65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.tmp" /SL5="$40016,10882072,119808,C:\Users\Admin\AppData\Local\Temp\65c95191a911dde3bac6e9b5eb4668b2_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2368
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD58cff4623ba6b804ae79e3b9a0e418191
SHA1081c5718d2bd064209d423d4dc72f2e2abb53138
SHA2563bc47878ad889969abb1783f79d9ff8fed3f4f2139c34f485183a34d14e71792
SHA51283bee762bac56eca7b122321c9cbddaaf1cfdd6f14eda788ce62a6fb7b9665fb681b0e3569739ec9b17464beadcd39b9db26f905074d57b6ab328a53d5ce25e0
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df