Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11-07-2024 08:44
General
-
Target
386fb9ee73a445e3d6ffe9d09b966a6b_JaffaCakes118.exe
-
Size
2.5MB
-
MD5
386fb9ee73a445e3d6ffe9d09b966a6b
-
SHA1
0fc4fbabba97f892ec21a94607aee7b471985a85
-
SHA256
37c610167cb0a6d55e63b60f8b667641554c700b1c950d5cc7eb6a5ae35d4f66
-
SHA512
27ab101b35ff5e67dbb83478c2f9eac08bcbfc55b5f9fb93192f4dd2b2fe30db38ea3b41ad354a723ee18aab34c1e17422f57f75b0b6580cf14979d60b172b20
-
SSDEEP
49152:oky796EvMtTx435MtV+Oj29Ls3t/cwCxHHlc2KP1z8o/MO2Uqed3yBI1r7:o7AEvgVOy29Ls3JslVYzjMO26ik
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\386fb9ee73a445e3d6ffe9d09b966a6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\386fb9ee73a445e3d6ffe9d09b966a6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-39LI8.tmp\386fb9ee73a445e3d6ffe9d09b966a6b_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-39LI8.tmp\386fb9ee73a445e3d6ffe9d09b966a6b_JaffaCakes118.tmp" /SL5="$5014E,2280122,153088,C:\Users\Admin\AppData\Local\Temp\386fb9ee73a445e3d6ffe9d09b966a6b_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OT4GA.tmp\WMF.exe"C:\Users\Admin\AppData\Local\Temp\is-OT4GA.tmp\WMF.exe" /aid=0 /sub=0 /sid=42 /name="Fallout NlÒ" /fid= /stats=lSnnEBWlOW6asHuyBBWDr3jtifkRVI+9a3rZ4FCKn7xKNnp2cFG5FeUU31SDvCcjn2pNBBmWZ4waYdXEKjXERw== /param=03⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54c219b78a305d3e52c811542154bb224
SHA17efe3e383b29c808cfb3ad0fd90d627ea7b2b2bf
SHA256a0dbdc08f771e32a5ef06f47b436afb270e860578971a974db0c34c0c1366a7c
SHA512bced9584568b011c0b2013e48d6b9503f77b01c57e2049722326a40363ce42c533e590c4583cf0cf3a5391f3208db8135b5afdc27ae7359af3ded66b11e628b8
-
Filesize
1.1MB
MD58811a0652c18dbcf68955f99df537eb8
SHA170cff6c43c0f873295dc085018639dff02f33012
SHA256d69f51e65e3944891ec9c392b3d7410d81f8f93e55b9071584bfd1d384862230
SHA512ed2ff6cfe272a8ae260233a1bb653adc0eaae13388418a9dea692b9924999d89b8677b8669fa24dcb0c606cfca7045bef779e1c58547f3f17d5096cbbe31d60a
-
Filesize
3.3MB
MD5665ecaa9b05b183eceb5fa566240b673
SHA18b115b8053905c20c14fe079695341345d2438a1
SHA2567da8e667bed83fe17f75f2836230e59e7d7c52ec9e45269f6c7a738446823932
SHA51256abfe393d84c244396be52843fbf31cbe10934674f60f8fe5a1ded4944f26aafd56b19f1be02e4de2dc2ee4e7e51d436351a86519f11a399ac483eb34e5c072
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
88KB
-
Filesize
192KB
-
Filesize
192KB