Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
23-05-2024 00:29
General
-
Target
6925b560ee6ddefcc0b5e8ada00fe31c_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
6925b560ee6ddefcc0b5e8ada00fe31c
-
SHA1
ad91d5496226ef7e5fbe35f8dc233dae7a13f4d2
-
SHA256
0be60d1362e9b812403ee5c78bd93d3643069b1f1ccdd486fa9931990273c655
-
SHA512
1b120f51b6f716c06b440c95bf3ed602927e6e842bb0c3b8573d43c737a912bf1f7b91e582eeacd3369bcab6442f24cf77bd8e73f4537ca18c852396daa7cec6
-
SSDEEP
24576:3TfEWQMHi9jzdDnAjuqK5dFv0oDoL2+8+LphzzPRlT3TT5oV4ljtK9BgxccrGevS:DcW4fPj/We+1hz24diovr+tf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6925b560ee6ddefcc0b5e8ada00fe31c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6925b560ee6ddefcc0b5e8ada00fe31c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-29H9J.tmp\6925b560ee6ddefcc0b5e8ada00fe31c_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-29H9J.tmp\6925b560ee6ddefcc0b5e8ada00fe31c_JaffaCakes118.tmp" /SL5="$400F8,1232121,726528,C:\Users\Admin\AppData\Local\Temp\6925b560ee6ddefcc0b5e8ada00fe31c_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD579cbc1b709e36f0a204d613db96b78a5
SHA1d9c4be78cc5cd7bfe90216ac76783992344bc5ac
SHA25683f8c7132b5b4a51e673ba5b2c72ab8d28a4bc924bbe729a598d94976deb0aab
SHA51294d9af8c12f32c536383644d436c360d406d69f9d8982db1fc21085537013f5fffddbc7be4c6d5d8bcb4c4117dbdb4dc88daaa36a2c1a229c92c0ae14e1baaa3
-
Filesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB