Overview

overview

7

Static

static

1

0be7e2cb50...18.exe

windows7-x64

7

0be7e2cb50...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    0be7e2cb50f4c7d4360d544c91cd3531

  • SHA1

    007347cffbf7c0a3d71ed578c4908b983446aeb0

  • SHA256

    9d9b0905b964ea02e38530a0b8c18b6569c8d159d3890c45d5aecad73a059c8e

  • SHA512

    68326dfe20294bd8329f31b967922578c2250fb97d7836abd6df90887fc173696d41e4e14b3689e2e29ef888a79b6db571f2f7c83bef3787c0eb0cd0eabd364b

  • SSDEEP

    24576:KMjhS4SFgEQ6KUKwP7mdG0igTV4FbXgIwLIR0C7NGo0AXiWQpJh5n98LAoa58h5q:Z3STVKiysNsVeb5Fz77JOhN98LDVq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\is-FRI4E.tmp\0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FRI4E.tmp\0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.tmp" /SL5="$4001C,976530,140800,C:\Users\Admin\AppData\Local\Temp\0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2380

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\is-FRI4E.tmp\0be7e2cb50f4c7d4360d544c91cd3531_JaffaCakes118.tmp
          Filesize

          1.1MB

          MD5

          394289faec0a43faea574588cb367018

          SHA1

          b02982a816782c3c16ad5a321dce0a79cab124a2

          SHA256

          89c8d27247ff86f189ebba01e27c47daa184a04c5f002130f9d336ca80d71202

          SHA512

          e99977ed9b3ea6607d347fe3e339cff40e70166db6a93443046cb7e0bc2a6f7c598503a55030f7d9ae0e8ede8b706bb4bd682bbdadf215641247b96bae0d09f4

          Download Submit

        • \Users\Admin\AppData\Local\Temp\is-J024P.tmp\_isetup\_shfoldr.dll
          Filesize

          22KB

          MD5

          92dc6ef532fbb4a5c3201469a5b5eb63

          SHA1

          3e89ff837147c16b4e41c30d6c796374e0b8e62c

          SHA256

          9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

          SHA512

          9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

          Download Submit

        • memory/2380-14-0x0000000000400000-0x0000000000526000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2380-16-0x0000000000400000-0x0000000000526000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2888-0-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

          Download

        • memory/2888-2-0x0000000000401000-0x0000000000417000-memory.dmp

          Filesize

          88KB

          Download

        • memory/2888-15-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

          Download