Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13/06/2024, 06:57
General
-
Target
a44fdafe26ec112ecec7fb3176ce5d1d_JaffaCakes118.exe
-
Size
11.8MB
-
MD5
a44fdafe26ec112ecec7fb3176ce5d1d
-
SHA1
7fdfc965b58977fe2c056bb9d252d6228a7ad1c2
-
SHA256
cb6004ab0bb1d6d2c71b14eb02644887c04c09a78c3326e7071508598e933e75
-
SHA512
a32f0ed138da1590579672926c4968ba3aaa2476bde751a202604bcd3ed50b9429d133c3e0307aef0e4f9b4a6ea1f417aeb45bce080e6ff28f9a4de0e24fadf7
-
SSDEEP
196608:vC7nOWVqDLFKxgu8FNlh+mBu7rQoR7LzVdLBa1RLgADaerwLzWZI8X0sCWk1N0yM:aTOWVqDRKCpFN+5AeLpdLBabzNrwLkVR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a44fdafe26ec112ecec7fb3176ce5d1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a44fdafe26ec112ecec7fb3176ce5d1d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C546L.tmp\a44fdafe26ec112ecec7fb3176ce5d1d_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-C546L.tmp\a44fdafe26ec112ecec7fb3176ce5d1d_JaffaCakes118.tmp" /SL5="$4001C,11702790,721408,C:\Users\Admin\AppData\Local\Temp\a44fdafe26ec112ecec7fb3176ce5d1d_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD58e2d270339dcd0a68fbb2f02a65d45dd
SHA1bfcdb1f71692020858f96960e432e94a4e70c4a4
SHA256506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811
SHA51231eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
672KB
-
Filesize
760KB
-
Filesize
760KB