4dcaa972a4e082dfab4edef5c6985b2f56cb66a9e3c83e79fe457ba409ad966f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe
Size

1.6MB
MD5

96d40b36a70bfe401cfab87e28668c8d
SHA1

95a8aa1a62d2b3a84fc154ea105905d83d75eabd
SHA256

4dcaa972a4e082dfab4edef5c6985b2f56cb66a9e3c83e79fe457ba409ad966f
SHA512

672b695b34b78f4f96ed58e6199852879895101c5936ce9999556aefb6bf5ae4aa91dfd6b52904b7ce1a4e2d252d5ccd677576d9aaa9537c71867d3f5063b4d9
SSDEEP

24576:uBWXN4OnILT9p+ci9zX7mL8YlpP3BZJTFtuQ3Qv88xEbZ+/pewTM/+Z7a:bVI/9AULH84QvVsMpe/K7a

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4980	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp

Loads dropped DLL 5 IoCs

pid	Process
4980	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp
4980	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp
4980	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp
4980	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp
4980	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4980	4288	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe	83
PID 4288 wrote to memory of 4980	4288	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe	83
PID 4288 wrote to memory of 4980	4288	96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\is-9PG4C.tmp\96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9PG4C.tmp\96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp" /SL5="$601E6,1233624,121344,C:\Users\Admin\AppData\Local\Temp\96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9PG4C.tmp\96d40b36a70bfe401cfab87e28668c8d_JaffaCakes118.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MLGDR.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MLGDR.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MLGDR.tmp\uwIknPJtj.dll

Filesize
954KB

MD5
b80026698edd25adf5da84433af924a6

SHA1
2853d2a88892bdda233f7bcde4aed9936e4eef69

SHA256
c1359930b619304f535af9a93631dbcfbf1578d585273a057964ee1b9ad3cdbf

SHA512
c5c170f9f5e113336212028ab3cb7f7da03fa449f9248c06aa3439807d5e5cc9411e4cfdae6ffcb8a61ac14cd4c14e725b60f18d264fb074de23ed1b3b487082

Download Submit
memory/4288-25-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4288-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4288-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4980-13-0x0000000005470000-0x00000000054AC000-memory.dmp

Filesize
240KB

Download
memory/4980-6-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4980-22-0x0000000007A80000-0x0000000007B73000-memory.dmp

Filesize
972KB

Download
memory/4980-28-0x0000000007A80000-0x0000000007B73000-memory.dmp

Filesize
972KB

Download
memory/4980-27-0x0000000005470000-0x00000000054AC000-memory.dmp

Filesize
240KB

Download
memory/4980-26-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4980-31-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4980-32-0x0000000005470000-0x00000000054AC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads