dd520038acba89fcec9dfcbbabe3bfb7d3a1c21f6c26333f14729875c0e050ae

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
Size

240KB
MD5

40336bbff8e9f7f050d4ac8fcf99bc43
SHA1

3692aaa550384f974e45b6ad28277a2ccda0043b
SHA256

dd520038acba89fcec9dfcbbabe3bfb7d3a1c21f6c26333f14729875c0e050ae
SHA512

088e95f4b0144db5f327686a7f41d6a735f8cfaa9bb0c95f939a7668a11f1f476476674b68597877cb03841725db2442717c0aab70e0b817046bf4034adc7a1c
SSDEEP

6144:n/6CVtDl8moKu4s8GL+nB9WBfAW5xESHpoh+rbbjZpa01Y:nCCDl8jxSn785uOc+HbjZ0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
488	fck.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fck.exe	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
File opened for modification	C:\Windows\fck.exe	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
488	fck.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2100	3312	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	87
PID 3312 wrote to memory of 2100	3312	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	87
PID 3312 wrote to memory of 2100	3312	40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40336bbff8e9f7f050d4ac8fcf99bc43_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  PID:2100

C:\Windows\fck.exe
C:\Windows\fck.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
d6bddd86f0e57974ea18702d78d848bd

SHA1
2db0ceb2745f5eb59391c845cbee010699cae0e4

SHA256
8dd35fce13f3392537c1788786fd935491e52edb57635739f724b09012aec56d

SHA512
1a74ab8bbc745cb93da524f7e1849e96892fdee45313aee292183d4d04d7d6576d6fa923ac398fb617b849628fd599a9f6fa8b98e3b01c4f343daa84b1456e54

Download Submit
C:\Windows\fck.exe

Filesize
240KB

MD5
40336bbff8e9f7f050d4ac8fcf99bc43

SHA1
3692aaa550384f974e45b6ad28277a2ccda0043b

SHA256
dd520038acba89fcec9dfcbbabe3bfb7d3a1c21f6c26333f14729875c0e050ae

SHA512
088e95f4b0144db5f327686a7f41d6a735f8cfaa9bb0c95f939a7668a11f1f476476674b68597877cb03841725db2442717c0aab70e0b817046bf4034adc7a1c

Download Submit
memory/488-10-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/488-8-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/488-14-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/488-15-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/488-16-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/3312-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3312-1-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3312-2-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3312-3-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3312-12-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads