03abb6d49292a9babecc582c4352573c991a1d692787c94543596bab9843ee65

Analysis

max time kernel
141s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38851991130cef0c3d50693784467747_JaffaCakes118.exe
Size

2.5MB
MD5

38851991130cef0c3d50693784467747
SHA1

38bf9725d25953922e12052eef80b9c93afa204c
SHA256

03abb6d49292a9babecc582c4352573c991a1d692787c94543596bab9843ee65
SHA512

f459d9a1b077ecb8a32ad72dcecd4a004e7c40b00004882fe72c099d7647d0bce406f3f01b6775e75626395f2bc00ff775651d99baeb0678813d62b177894006
SSDEEP

49152:mvzpHWlzSHlMc+TE8eF6q+dUAPOU6iuW0FwiHtrVG2nJJDYR3mYCcVssxn+vq2TK:CzkbFTEUqUAU6iOwWX1rk3mYCcNgdbIx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2680	38851991130cef0c3d50693784467747_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe
2680	38851991130cef0c3d50693784467747_JaffaCakes118.tmp
2680	38851991130cef0c3d50693784467747_JaffaCakes118.tmp
2680	38851991130cef0c3d50693784467747_JaffaCakes118.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	38851991130cef0c3d50693784467747_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2680	2368	38851991130cef0c3d50693784467747_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\38851991130cef0c3d50693784467747_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38851991130cef0c3d50693784467747_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\is-9RQA0.tmp\38851991130cef0c3d50693784467747_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9RQA0.tmp\38851991130cef0c3d50693784467747_JaffaCakes118.tmp" /SL5="$4001C,2378240,54272,C:\Users\Admin\AppData\Local\Temp\38851991130cef0c3d50693784467747_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9RQA0.tmp\38851991130cef0c3d50693784467747_JaffaCakes118.tmp

Filesize
692KB

MD5
4004a08b31830602e97978f3d260b5d5

SHA1
a0f4df00c517c114ba9de09681d9bee7851dd602

SHA256
97108defbfb4a6ffe7a98209a1ea69b400dc8903524b16594649ce819eb82d8e

SHA512
008c337392868231aeeedfe99fedd63f19ccb2a5b441081d0b918608d8c693b5d466675b5780a344df53e0e00cda1420b7c021163d746bee37e369944967bb46

Download Submit
\Users\Admin\AppData\Local\Temp\is-S6NEK.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-S6NEK.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/2368-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2368-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-28-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2680-23-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2680-18-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/2680-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2680-22-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2680-29-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2680-30-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/2680-66-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads