Analysis

  • max time kernel
    140s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 22:06

General

  • Target

    a29dea65d59a645b81d3d986335236b7_JaffaCakes118.exe

  • Size

    3.8MB

  • MD5

    a29dea65d59a645b81d3d986335236b7

  • SHA1

    2cd723bdbf23cf05a81a2b78ad59ef5ddfe4484f

  • SHA256

    0cebf87525818bcade723e3707a395a4d830eac75cfc3a68997711175f08389d

  • SHA512

    2e0b167f20d39f6efbd6259e336bfd59b2ef8ec6e427b35cf034fc226e282f2562d7c7c60e637c90c424610aa2e95ea7553bf0c13f0563fa8335dff7ecf762a5

  • SSDEEP

    98304:VY3h1Ofy7iqg2OYONOlUkct2JQoBgqIQ1cc0nqpV9u1O:V6Of4i6OYON/J2JV2rVhqpVMo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a29dea65d59a645b81d3d986335236b7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a29dea65d59a645b81d3d986335236b7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\is-BL7G3.tmp\a29dea65d59a645b81d3d986335236b7_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BL7G3.tmp\a29dea65d59a645b81d3d986335236b7_JaffaCakes118.tmp" /SL5="$80126,3522987,121344,C:\Users\Admin\AppData\Local\Temp\a29dea65d59a645b81d3d986335236b7_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-BL7G3.tmp\a29dea65d59a645b81d3d986335236b7_JaffaCakes118.tmp

    Filesize

    1.1MB

    MD5

    34acc2bdb45a9c436181426828c4cb49

    SHA1

    5adaa1ac822e6128b8d4b59a54d19901880452ae

    SHA256

    9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

    SHA512

    134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

  • memory/1152-8-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/1152-13-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/3024-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/3024-2-0x0000000000401000-0x0000000000412000-memory.dmp

    Filesize

    68KB

  • memory/3024-12-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB