Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 14:12

General

  • Target

    a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.exe

  • Size

    7.4MB

  • MD5

    a0f36d128fa3e91bbff2af5a2df599b5

  • SHA1

    6d5ada4a17f5e3489434ff39c29ce6def44b6a77

  • SHA256

    ee62651c559c7d15edc945ff887e7c52e59c8eda8dc01a6b60a27aaa1475d8f4

  • SHA512

    2a4482eda25eb3576924dc5c35a49e298e9bc40325a06e7acd8b673c6d6e725f99160b228aa239834c92d0a3582cb13e7f1a0be2e833c411d9888fd76b4ce2bb

  • SSDEEP

    196608:vvQrtZsRR0cZ+GZPYwdLy5lxetqrlQjoGcCyaL:XQBZ9+tNjoa

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\is-O14AJ.tmp\a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-O14AJ.tmp\a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.tmp" /SL5="$4014E,7060615,721408,C:\Users\Admin\AppData\Local\Temp\a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-O14AJ.tmp\a0f36d128fa3e91bbff2af5a2df599b5_JaffaCakes118.tmp

    Filesize

    2.4MB

    MD5

    8e2d270339dcd0a68fbb2f02a65d45dd

    SHA1

    bfcdb1f71692020858f96960e432e94a4e70c4a4

    SHA256

    506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

    SHA512

    31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

  • \Users\Admin\AppData\Local\Temp\is-RCND1.tmp\isxdl.dll

    Filesize

    121KB

    MD5

    48ad1a1c893ce7bf456277a0a085ed01

    SHA1

    803997ef17eedf50969115c529a2bf8de585dc91

    SHA256

    b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

    SHA512

    7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

  • memory/1728-0-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1728-2-0x0000000000401000-0x00000000004A9000-memory.dmp

    Filesize

    672KB

  • memory/1728-14-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/2468-8-0x0000000000400000-0x0000000000679000-memory.dmp

    Filesize

    2.5MB

  • memory/2468-15-0x0000000000400000-0x0000000000679000-memory.dmp

    Filesize

    2.5MB