Analysis

  • max time kernel
    106s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 05:02

General

  • Target

    a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    a3e7551212f7005c156d853bf22ce5a8

  • SHA1

    a582af1a6b3d349ee22c18f895e5dd850e671a48

  • SHA256

    dbf5c857bdab81196d45c08b69188ac3eb32979776238f197a3d77c508c6f026

  • SHA512

    1f3e70627d9f72abf6afa2d3ef26f128d016b4b934caceb3c99a2fe1b4a05b6a0525bc752cfcac5415baff8675202569d73f4104bb975b29fd267aea843287be

  • SSDEEP

    49152:piCC2brnCmsLTz2a8Y3CdMX0iPDmhIfeuW9q0GJyFaw:DfnDs7u+IMXZSyrW9vGJycw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp" /SL5="$601C8,1335443,121344,C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp

    Filesize

    1.1MB

    MD5

    34acc2bdb45a9c436181426828c4cb49

    SHA1

    5adaa1ac822e6128b8d4b59a54d19901880452ae

    SHA256

    9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

    SHA512

    134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

  • C:\Users\Admin\AppData\Local\Temp\is-TG9DN.tmp\OqIEFuprtaC.dll

    Filesize

    1.0MB

    MD5

    16090d48f4c90ffc959e878e7e697cbd

    SHA1

    dba2748e05b8b2c1f7d8fd7f9c677764a3365946

    SHA256

    e61ea546a518289762cb8ba240863f5c8f82b9c8de5d44281d1af3bc6c1104c6

    SHA512

    5679ecbf8fbb795660f225f5712aa16a6e26a34615cb7eb04e5a6ba1165fd10a775d9ae09871f83e2fb8f1628320187cb56ad62be6a4a8b8aae9227845375403

  • C:\Users\Admin\AppData\Local\Temp\is-TG9DN.tmp\isxdl.dll

    Filesize

    121KB

    MD5

    48ad1a1c893ce7bf456277a0a085ed01

    SHA1

    803997ef17eedf50969115c529a2bf8de585dc91

    SHA256

    b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

    SHA512

    7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

  • C:\Users\Admin\AppData\Local\Temp\is-TG9DN.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • memory/3984-25-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/3984-26-0x00000000032F0000-0x000000000332C000-memory.dmp

    Filesize

    240KB

  • memory/3984-6-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/3984-68-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/3984-22-0x0000000004B30000-0x0000000004C3E000-memory.dmp

    Filesize

    1.1MB

  • memory/3984-61-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/3984-38-0x00000000032F0000-0x000000000332C000-memory.dmp

    Filesize

    240KB

  • memory/3984-13-0x00000000032F0000-0x000000000332C000-memory.dmp

    Filesize

    240KB

  • memory/3984-27-0x0000000004B30000-0x0000000004C3E000-memory.dmp

    Filesize

    1.1MB

  • memory/3984-33-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/3984-34-0x00000000032F0000-0x000000000332C000-memory.dmp

    Filesize

    240KB

  • memory/3984-37-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/4564-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/4564-24-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/4564-2-0x0000000000401000-0x0000000000412000-memory.dmp

    Filesize

    68KB

  • memory/4564-70-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB