Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 13:06

General

  • Target

    1b69704d7ef0b51749f88daa1515c789_JaffaCakes118.exe

  • Size

    4.9MB

  • MD5

    1b69704d7ef0b51749f88daa1515c789

  • SHA1

    47cc042f38a62c53b9ad6abe29100511bb060134

  • SHA256

    cdc6683d947458613fdea9781ae55baff0c7fcdf9f313dab51d242082f4984e5

  • SHA512

    d9e074eb2286e840453d624d53a31f4f2c80c722c2551f4ee629ec351ed094c98af77be652f761a0bb0a563c41bcbb7f00cb19dd49aae156aff944ab7f037fec

  • SSDEEP

    98304:cBh7FXW6Jyyb4eZTa39pf3vdeQUFbXcAyXycSuCRoySw9iHXUSeZ3Qf+zb:wx583Npf3g9XcbycS7RoypYHXc3z/

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b69704d7ef0b51749f88daa1515c789_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1b69704d7ef0b51749f88daa1515c789_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-0-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-2-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-4-0x0000000000400000-0x00000000013B8000-memory.dmp

    Filesize

    15.7MB

  • memory/1688-3-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-1-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-9-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-8-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-6-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-7-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-5-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-10-0x0000000076831000-0x0000000076832000-memory.dmp

    Filesize

    4KB

  • memory/1688-11-0x0000000076830000-0x000000007683A000-memory.dmp

    Filesize

    40KB

  • memory/1688-13-0x0000000000400000-0x00000000013B8000-memory.dmp

    Filesize

    15.7MB

  • memory/1688-14-0x0000000000400000-0x00000000013B8000-memory.dmp

    Filesize

    15.7MB

  • memory/1688-15-0x000000007EF50000-0x000000007EFAC000-memory.dmp

    Filesize

    368KB

  • memory/1688-17-0x0000000076830000-0x000000007683A000-memory.dmp

    Filesize

    40KB