c8572611778fa3c61ab750aebb1f95ef50aac3d6acb8b4098fa95544a6a18118

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe
Size

7.1MB
MD5

6945d3e200e5af9ffad0312f202847a6
SHA1

6e32b8c5a86f25c0c3bf21891db5210aa73be5c5
SHA256

c8572611778fa3c61ab750aebb1f95ef50aac3d6acb8b4098fa95544a6a18118
SHA512

e66feac0da549bcf173c07ee08554d91337a778a60c908c430aef4223a7699a5b32cc9c4bff83196fbdb85735141174119c19c39138cb309a4c77d9afe72c6cf
SSDEEP

196608:Pu989Cwmvzx3fdDr92KAxSam1cB+wgAzq29l4:2e9Cws3fVr9nWI/I8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp

pid process

4592 6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

Processes:

6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp

pid	process
4592	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp
4592	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp
4592	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe

description	pid	process	target process
PID 1964 wrote to memory of 4592	1964	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp
PID 1964 wrote to memory of 4592	1964	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp
PID 1964 wrote to memory of 4592	1964	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe	6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\is-HGA2P.tmp\6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HGA2P.tmp\6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp" /SL5="$A0100,7144869,116224,C:\Users\Admin\AppData\Local\Temp\6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-H5F2N.tmp\NewAdvSplash.DLL

Filesize
8KB

MD5
7ee14dff57fb6e6c644b318d16768f4c

SHA1
9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce

SHA256
53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7

SHA512
0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H5F2N.tmp\callnsis.dll

Filesize
17KB

MD5
fb01525c33d5fb9f092698ded248b8dd

SHA1
0a25f35a456bc256d84160fedf26185db48cca0d

SHA256
861c3081eb0c35114bec3aed57cbe9761c2ac283c0aa639038d79290a26fbd64

SHA512
d5f23352c52c91267063ccadc82a0897199e4b93cb3fbb2c28178384d4a35b5a17efed43c61a8c3a8323cbe2a0397323280869ee0c5d24ead177d70760847ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HGA2P.tmp\6945d3e200e5af9ffad0312f202847a6_JaffaCakes118.tmp

Filesize
873KB

MD5
9a52d7c301b67862af7c87293dbf1943

SHA1
a6181c1210015d36d709af16b155c7cc801add7f

SHA256
d9a8033586ecef5a971aa6162e7d002778ee3cd40c164e3a1dd9f58984c1c546

SHA512
d6d49d24d472581b5c52dba6382a6c48a55c9eaa237cf2bf85e9ad415a5344c1172934ddb0703f41cd0b5fc7151940b1c294b7a0fcc35933901494c37e778848

Download Submit
memory/1964-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1964-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1964-38-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4592-12-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/4592-37-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download