bfe44bc599c578c5e2b88433b28e918668f8bd2d04b45d3a1f69acc7c20678e3

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe
Size

2.0MB
MD5

6bdeaeafaf2ee64d7000a436c95b5e78
SHA1

662d0626735864c7b08215476cb05479f356e6f6
SHA256

bfe44bc599c578c5e2b88433b28e918668f8bd2d04b45d3a1f69acc7c20678e3
SHA512

7c90f8d2568c8710e9f2adbf859ad6bba14685c80750965f9c2d491e5a73f4db03ab3622df54ec13fa46097f98b42188ea49c6d6db7e9f9324081e6f0b2bff55
SSDEEP

49152:DngwZ0/yhaLkuEt1+Cw6NiQT2DgkzoALB:UZ6ILrEqCzTvkEAV

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

Processes:

MpSigStub.exe

pid process

2408 MpSigStub.exe
2408 MpSigStub.exe
2408 MpSigStub.exe
2408 MpSigStub.exe
2408 MpSigStub.exe
2408 MpSigStub.exe

pid	process
2408	MpSigStub.exe
2408	MpSigStub.exe
2408	MpSigStub.exe
2408	MpSigStub.exe
2408	MpSigStub.exe
2408	MpSigStub.exe

Drops file in System32 directory 2 IoCs

Processes:

MpSigStub.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File created	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe

description	pid	process	target process
PID 2480 wrote to memory of 2408	2480	6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe	MpSigStub.exe
PID 2480 wrote to memory of 2408	2480	6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe	MpSigStub.exe
PID 2480 wrote to memory of 2408	2480	6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe	MpSigStub.exe

C:\Users\Admin\AppData\Local\Temp\6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\system32\MpSigStub.exe
MpSigStub.exe /program "C:\Users\Admin\AppData\Local\Temp\6bdeaeafaf2ee64d7000a436c95b5e78_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2408

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\DA47D798159628749B410D34AEA9C5A9-Sigs\1.199.3210.0_TO_1.199.3265.0_MPASDLTA.VDM._P
Filesize
945KB

MD5
c49fc388fcb0d1e33f46fc85cd5707a7

SHA1
d82e43bc1338bd05b5233e9412c8bccc0cfbbba7

SHA256
76035011594523036b5c0623465b3aaacd6fa80a83f74ab55321b200a81be9e7

SHA512
489e13f687e4cb0a357c62644bc5e4f58101bd38896d471065e307dcbe92662f2821f0affc27b60d530daf475e3f4052f64f7147db5fb4d022e68cf89e0a4e7d

Download Submit
C:\Windows\Temp\DA47D798159628749B410D34AEA9C5A9-Sigs\1.199.3210.0_TO_1.199.3265.0_MPAVDLTA.VDM._P
Filesize
1.1MB

MD5
6060da9437d23cdaa6f7c2dbb07026f6

SHA1
8fe4b8729961dfc6d1462608b4857371b54536f1

SHA256
9e38bd13161f9c22b57d7932e3065061a2c81548f11aeec4520d2efc1b5df1c4

SHA512
f3710dce41ab40fccc6b64ea440b6df4eca29477dbf6d98752e3166c4c6c24cc34b66e4bab4db21fbc8f9a6d1aec27f3aa85af107fb0a0440e7833ca1be09cba

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm
Filesize
11.1MB

MD5
b17051cea6ecf263ef7eb4b79fa50763

SHA1
ad15f2f519b32ffce10e23e6ee6436b0d49136e0

SHA256
f10a3dbeaba655f7f595c8954cb85d5e7804a2cdcf6a09c0544eeb739d442dfa

SHA512
f904c88765b9dea30a2276ac988dbc7daa2ca19c879983ab03fa4c7665eec987644ec8734711b7d02597e3b4af8b2625a54930f7afb5ad095c966bef3c087475

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm
Filesize
331KB

MD5
f0f8b583c084699ddbf036b892058f6e

SHA1
3d7b233ea117b55b3708d29fda451d39313ff27a

SHA256
d2ca676148c1f59c2d3494bb0aa28127d2957ea8c2f494ddebe7e1249038e9a1

SHA512
383a8cdf759e7b4395e0e295700db316c8d06c8589333f22ddc29efdf350c66f5fd8b729f95a0e2a1b3a0798f8af0b06a9bb4971a300039d9baea6101d233697

Download Submit
\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpengine.dll
Filesize
7.8MB

MD5
97bdc9a400eef273cc4b336614ca74bd

SHA1
b0c55c5f48ec0f32bcac631005755c722913e21c

SHA256
2b0792816c882c8b7dafe93e8148df94b1c0786287272e3fe4005166751069ae

SHA512
7dbe3c6b11ed5997d78bc4982f5b485ad61cc779add961899922a62df8b010dd3481a6236d631c9557816e84de8e4b16d8b66362b04ec6becb16fe85b8169e86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads