Analysis
-
max time kernel
11s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
09/07/2024, 05:05
General
-
Target
2f136c476800a0860e33e58d60fbe43e_JaffaCakes118.exe
-
Size
22KB
-
MD5
2f136c476800a0860e33e58d60fbe43e
-
SHA1
908da0ce6b2474b0b88d62a10dd8536e519f9d42
-
SHA256
e8cdc9d930066ec5d81547da4c2dafa0b1711a50921f5dbd1e63595a690c2130
-
SHA512
a24ccaaf430f08690538e4b9f6f74506669bad68d4cdff61a0ecd81a9c2d79725a45c9cd2aec45f1ca5004f8dab58ab5b1cd97c13a82fcd33cbd6caa62925768
-
SSDEEP
384:dj0R2vDjSFGQl19NTYzBADzxosvqxVZvcPH2foE08xH4SYGN3x7RQpL:yR23SF/hkSNl6VJ6GoEwS1ZA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f136c476800a0860e33e58d60fbe43e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f136c476800a0860e33e58d60fbe43e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\pcpo32.exeC:\Windows\system32\pcpo32.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD52f136c476800a0860e33e58d60fbe43e
SHA1908da0ce6b2474b0b88d62a10dd8536e519f9d42
SHA256e8cdc9d930066ec5d81547da4c2dafa0b1711a50921f5dbd1e63595a690c2130
SHA512a24ccaaf430f08690538e4b9f6f74506669bad68d4cdff61a0ecd81a9c2d79725a45c9cd2aec45f1ca5004f8dab58ab5b1cd97c13a82fcd33cbd6caa62925768
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB