0ea28e5ba67fbf9ee17a47d02a22ad14d525a5bc9717489e669ff4ed0d536c90

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe
Size

1.6MB
MD5

b312691f6ddd8dc7a9d7421cc554da48
SHA1

64ae06261071af0aa7bc037ede5630a4694e2d05
SHA256

0ea28e5ba67fbf9ee17a47d02a22ad14d525a5bc9717489e669ff4ed0d536c90
SHA512

192ef78e0e91eb923be2690557aee3af95f567bb42bb55756bfc93530882dc0ceb7e6e7e936b1a62a0d8f885d1897e06015ff501dd9560525225a4dcbc19a490
SSDEEP

24576:qBWWN4OnILT9p+ci9zX7mL8YlpP3BZJTFtuQ3Qv8WEbZ+/pewTM/+Z7M:v2I/9AULH84QvUMpe/K7M

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4380	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp

Loads dropped DLL 5 IoCs

pid	Process
4380	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp
4380	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp
4380	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp
4380	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp
4380	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4380	2552	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe	82
PID 2552 wrote to memory of 4380	2552	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe	82
PID 2552 wrote to memory of 4380	2552	b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\is-EBNJ8.tmp\b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EBNJ8.tmp\b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp" /SL5="$900F8,1233624,121344,C:\Users\Admin\AppData\Local\Temp\b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-246GP.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-246GP.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-246GP.tmp\uwIknPJtj.dll

Filesize
954KB

MD5
b80026698edd25adf5da84433af924a6

SHA1
2853d2a88892bdda233f7bcde4aed9936e4eef69

SHA256
c1359930b619304f535af9a93631dbcfbf1578d585273a057964ee1b9ad3cdbf

SHA512
c5c170f9f5e113336212028ab3cb7f7da03fa449f9248c06aa3439807d5e5cc9411e4cfdae6ffcb8a61ac14cd4c14e725b60f18d264fb074de23ed1b3b487082

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EBNJ8.tmp\b312691f6ddd8dc7a9d7421cc554da48_JaffaCakes118.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
memory/2552-26-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2552-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4380-13-0x00000000032F0000-0x000000000332C000-memory.dmp

Filesize
240KB

Download
memory/4380-6-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4380-22-0x0000000003530000-0x0000000003623000-memory.dmp

Filesize
972KB

Download
memory/4380-27-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4380-29-0x0000000003530000-0x0000000003623000-memory.dmp

Filesize
972KB

Download
memory/4380-28-0x00000000032F0000-0x000000000332C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads