f744523e9d516884971543eed7fe550466db3b4be1099326fe302f4440499fce

Analysis

max time kernel
104s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe
Size

315KB
MD5

3ed7736dd1f22babe69da545c128ccb6
SHA1

f37348f9af7afa3846b8b91e8f75360d690ef17f
SHA256

f744523e9d516884971543eed7fe550466db3b4be1099326fe302f4440499fce
SHA512

780f8cadb513733167560d2181e7bd0fce3ac849e9adbca89b6a639c351d24fe07a0e19fea8f3be7ce0d447994a44762ed01d90cd7c7b9300802a22905aefc0f
SSDEEP

6144:fXxsrn4BWDnPdubKbpxY4uBKyB1Bl3NJWC54csdEEp8CZMuQg:fBsr4vbK2KW1Byf58CWg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3576	system.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\system.exe	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\system.exe	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3576	4520	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe	86
PID 4520 wrote to memory of 3576	4520	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe	86
PID 4520 wrote to memory of 3576	4520	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe	86
PID 4520 wrote to memory of 2800	4520	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe	87
PID 4520 wrote to memory of 2800	4520	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe	87
PID 4520 wrote to memory of 2800	4520	3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ed7736dd1f22babe69da545c128ccb6_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files\Internet Explorer\system.exe
  "C:\Program Files\Internet Explorer\system.exe" -ALING
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\system.exe

Filesize
315KB

MD5
3ed7736dd1f22babe69da545c128ccb6

SHA1
f37348f9af7afa3846b8b91e8f75360d690ef17f

SHA256
f744523e9d516884971543eed7fe550466db3b4be1099326fe302f4440499fce

SHA512
780f8cadb513733167560d2181e7bd0fce3ac849e9adbca89b6a639c351d24fe07a0e19fea8f3be7ce0d447994a44762ed01d90cd7c7b9300802a22905aefc0f

Download Submit
C:\Windows\SysWOW64\Deleteme.bat

Filesize
212B

MD5
31d8ee01061b6bd82e5a01c50ca2852f

SHA1
cbd52069813b749110d2d31e50cbbe6ea36ee54c

SHA256
c7ff3989ce87fb401c1c0a6093aa70064767a98f7660649ef76151fe6edb492e

SHA512
5d5f488022e8358af44320410484b6d9cfd4aa92e08a6f21643184ec52a554d6c1df9318d5c2a26d895c508d6192fcf33892e34f6a4ae05a8c6b1dc92eb6244e

Download Submit
memory/3576-10-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/3576-9-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3576-11-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/3576-16-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3576-17-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/4520-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4520-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/4520-2-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4520-3-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4520-14-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads