Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
1c0ba2f64e0e3787adf106f27f7b728c
-
SHA1
f37a7824899d432330f2bf214e96fa48b9fdce31
-
SHA256
7eab61dcb8a846711b171f33ae507e8546f84c16e626520b17260bdfd5f042e1
-
SHA512
1a98cb23e211376f3cf9b72a2e3bb32d5c996ce695e2b7e5ade7b0f12f8ee109e53804e13aeb6e96a1fc177dddb48e256faa89d592fd708663d6e3bd3db9a462
-
SSDEEP
49152:dqgazxcGYN139lnk30ray05H8/cI83YeEgytVle:dqgazxc5H39ln2Ny0WmYdJt/e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 320 vbojssatzdxav.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe 1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1436 wrote to memory of 320 1436 1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe 81 PID 1436 wrote to memory of 320 1436 1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe 81 PID 1436 wrote to memory of 320 1436 1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe"C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe"2⤵
- Executes dropped EXE
PID:320
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD51e8267c0764bb03b23261fc8c7d4174f
SHA18e91f2a5fe05baa0375c92f58461adb24bbc3322
SHA256cea387dab05eb23d5e1f59e55263aed96beb184eb9d2acc175f912df4c74d690
SHA5129c1a9550c47d7c3094aec89f73ce90f9ed162d9dd9c6e41fc10b899469a30140811352672895fae9b95870fe1800162543639c99efc0638dab83417043891971