Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
08/07/2024, 05:21
General
-
Target
2b1f6992b4e5a1c91f9a61274c7c7612_JaffaCakes118.exe
-
Size
21KB
-
MD5
2b1f6992b4e5a1c91f9a61274c7c7612
-
SHA1
1add3a03dabf1b269353c777d90ba144cf57d39f
-
SHA256
a8ad1aada17c426b31bd5b336cfa097684c0cf7db45fe47d3b273e6067495767
-
SHA512
d957cea20a855d516fd6aaa34a42026e89e74242d5756d3909afb148fff1d5bc370be65b83da0bd42d237a9698780dbd302c60451f811320c6e5f97dd5394549
-
SSDEEP
384:mji7GOu9kIokmgU6dB3uSZR8Q/pIurIE25llglkfUguTWQhAXivwdY231uH3if2F:VMk1gpea//kT5lKkpua40BY2a3e2IVXI
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b1f6992b4e5a1c91f9a61274c7c7612_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b1f6992b4e5a1c91f9a61274c7c7612_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 922⤵
- Loads dropped DLL
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD58c9f5bc173354aa9927affae1ba237f8
SHA1a0003121651322e962158f72bc10b2a553917ba7
SHA25694028b2eef03d652fc0fa266a73125e1d9ab834e72c495cd71ffae17fbd9e159
SHA512936c8a89988eaaa732be275f2452933d1e3ac5b16759a467388d3552ff306913a2c397c1d67527f928fc9416bbb8515080728f60e91e1b2f043e315bb6693489
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB