Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 11:40

General

  • Target

    79077e6e03b53c5ea0e9d6afaecd3078_JaffaCakes118.exe

  • Size

    210KB

  • MD5

    79077e6e03b53c5ea0e9d6afaecd3078

  • SHA1

    c358b013881e68f996980e044b96b2e9a6826d2b

  • SHA256

    166ed64c4ea2357f1faaac126931dfb6b60dc3fcfdf8e5e71d6d2f2b1563828e

  • SHA512

    f65ea07a1df8e1a4ccb00f665c0a04fc1515a133d6bee159c2b021fd81978f3339eb3eec6a2c19f3898d3174155ab863006fc747290755fdc65d41fe375bd036

  • SSDEEP

    3072:AZYfYfc9tuswPQmHWgNr7mJfzKIsMdyjzSHZDDB6m+4HqVvQOhHFWUrJ9TH:AsYfcDKQUB7mROMjxlHqVoORL

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\79077e6e03b53c5ea0e9d6afaecd3078_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\79077e6e03b53c5ea0e9d6afaecd3078_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Users\Admin\AppData\Local\Temp\79077e6e03b53c5ea0e9d6afaecd3078_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\79077e6e03b53c5ea0e9d6afaecd3078_JaffaCakes118.exe"
          3⤵
            PID:2076

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1200-4-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/1200-3-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/1640-0-0x0000000000400000-0x000000000043D000-memory.dmp

              Filesize

              244KB

            • memory/1640-5-0x0000000000400000-0x000000000043D000-memory.dmp

              Filesize

              244KB

            • memory/2076-1-0x0000000000400000-0x000000000043D000-memory.dmp

              Filesize

              244KB