f768673631bbbcbb6f4c119994fb4ecb8c4090c41cfee86fc6e46860583241da

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe
Size 8.2MB
Sample240602-28effaaf4t
SHA256 f768673631bbbcbb6f4c119994fb4ecb8c4090c41cfee86fc6e46860583241da
MD5 8fc57cf6c5966cb0880bfed05e442320
SHA1 5b492b991d20c8e9dd2038104fba86abb8a4eb5c
SHA512 82e14eef2d700c976cc8bbf97442df6de37d805565e184f9251af05cb44353e4a9451c2edd38a377357ae536b09a8f1168057b0cb6f2458aac9d3eeac65307ee
SSDEEP 196608:4P5RveFU8MXMMONfwutJ+5y+DsEvnAt+sum:E3veFAXMldtI5y+nvGom
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1912	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

pid	Process
3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe
1912	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp
1912	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1912	3020	8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\is-A7EV8.tmp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A7EV8.tmp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp" /SL5="$400F4,8350975,71680,C:\Users\Admin\AppData\Local\Temp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-7O36L.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp

Path \Users\Admin\AppData\Local\Temp\is-A7EV8.tmp\8fc57cf6c5966cb0880bfed05e442320_JaffaCakes118.tmp
Size 704KB
SHA256 4b4a352f1d37076245c0dfb9691debbdd71e2d1a111ab4114d6ea63e26fca00e
MD5 668fd6d9e6db663b9a16169bbed6b2ef
SHA1 7bbfbf7c6e0d4f3b0347a3801dc76e6919788820
SHA512 2bd381643dd3a0928370e45bab0225abb66a2df395285313ba94795f583ff51ebb667427b2994db390d5d1c02735894248b5a3a19d297daa99aad01b5902d078
SSDEEP 12288:XTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5wURNRx9QF:jPcYn5c/rPx37/zHBA6pFptZ1CEQq5RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-14-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1912-16-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/3020-3-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/3020-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3020-15-0x0000000000400000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads