3672feec56632af69a7119922ef66ef94722b769bd8907b527b1d018c54b3bcb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe
Size

269KB
MD5

47d4c0f6d914b581d2e511ce45dde690
SHA1

9a5b1f6bb816863f8e06183bd4c7d90f0e500498
SHA256

3672feec56632af69a7119922ef66ef94722b769bd8907b527b1d018c54b3bcb
SHA512

728ebd4a330a694c2c0cd446336dea464be26f785e91f0ad9528b721f2d5de41bb8cd1f8ff6f6c0145362aa8c84bba46da93501448ec44b1cae63fa912c5632e
SSDEEP

6144:XunoY0hiUDIqPRU1AwbrET9VVBW1oslk8hGXinNaNlTuF1wrw:XyoniUR5UH/ETzHWyb8ginNGhKwU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2052	wincll.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\wincll.exe	47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe
File opened for modification	C:\Windows\wincll.exe	47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	wincll.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1408	3448	47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe	87
PID 3448 wrote to memory of 1408	3448	47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe	87
PID 3448 wrote to memory of 1408	3448	47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe	87
PID 2052 wrote to memory of 3820	2052	wincll.exe	88
PID 2052 wrote to memory of 3820	2052	wincll.exe	88

C:\Users\Admin\AppData\Local\Temp\47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47d4c0f6d914b581d2e511ce45dde690_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  PID:1408

C:\Windows\wincll.exe
C:\Windows\wincll.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
a7c84b0fb23e6266cfc9aafb3cfe3cde

SHA1
1e866b97505c2776ff5214fea5dbd9ce94a47ceb

SHA256
1d409f087f1f4a2cadad269ea136645a59a0bc1b2777fe2751bd635c4667e3d0

SHA512
e947c12b1a102a8a5632a1c8361c14db7887cb01751b36798b8c3fc65fb19f68f6fd8b24dbf898403e0a2198961b2cf081ac86833a9e7bfcc238179c979cbb81

Download Submit
C:\Windows\wincll.exe

Filesize
269KB

MD5
47d4c0f6d914b581d2e511ce45dde690

SHA1
9a5b1f6bb816863f8e06183bd4c7d90f0e500498

SHA256
3672feec56632af69a7119922ef66ef94722b769bd8907b527b1d018c54b3bcb

SHA512
728ebd4a330a694c2c0cd446336dea464be26f785e91f0ad9528b721f2d5de41bb8cd1f8ff6f6c0145362aa8c84bba46da93501448ec44b1cae63fa912c5632e

Download Submit
memory/2052-8-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2052-11-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2052-14-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2052-15-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2052-16-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3448-0-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/3448-1-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3448-2-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/3448-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/3448-12-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads