c88a21a5af290ad81695bca79c3dbc2eedf0d35b307d208cc6cfe531cdb0e50b

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
Size

350KB
MD5

59f5b5b38268cf2a7c345d6cc3f8f303
SHA1

39b898873c2a32f05b82617e88018118dc33be3f
SHA256

c88a21a5af290ad81695bca79c3dbc2eedf0d35b307d208cc6cfe531cdb0e50b
SHA512

686711fd57a235a1a94204b5ffb12d33dfa6f2df9995a25754d67a6b5646489ae522a1b9d7ba32c4a9f090fc1340d9917819785da73544a84185396c0e3bfacb
SSDEEP

6144:Pvd/T0yclQcvohI8e7xYJSpctM0v66CLj+W9RvGdQPSMDrpy03Trdexgw:PF70HpSI8elUv66y6W9lG2znpTjIB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2564	9933.tmp

Loads dropped DLL 3 IoCs

pid	Process
2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2564	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2564	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2564	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2564	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2644	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2644	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2644	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2644	2924	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\9933.tmp
  C:\Users\Admin\AppData\Local\Temp\9933.tmp
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe" --cp "C:\Users\Admin\AppData\Local\Temp\9944.tmp"
  2⤵
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9933.tmp

Filesize
294KB

MD5
f6bc9553546d35afa1ecf723f72ebad2

SHA1
586557e9a1789d6b7751f0bdf5b842d0e8c791a7

SHA256
2f00f38558a81f10bf7337c5548bc1fd69d2b555b8dba364715574af1f040836

SHA512
e85c5ba1991cfbacff4dca8151553ad1eed3f84394ec5b15fdf432ea98ed526debba11f6b95a568c92e77d7e1531318970a8759b704d0ca40e75277c6621048e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9944.tmp

Filesize
350KB

MD5
9da2c61ac19989a09215401ae3200f1f

SHA1
b7cce09c240a4ef32d5c079195125c786c09901f

SHA256
4685f8630ec6dbb6ccfd1c41784d12aec9f05f5bf446529b946de9d08c9e0312

SHA512
c7e0d1603c055bbd4c6fd2b724340dae13a19f3e096e4ad055409651d0ae98302aa48e1b9bec2442b69ccabd15f382aea91e54be84db8357780fb494a2c8b9d2

Download Submit
memory/2564-15-0x0000000000400000-0x0000000000449810-memory.dmp

Filesize
294KB

Download
memory/2564-27-0x0000000000400000-0x0000000000449810-memory.dmp

Filesize
294KB

Download
memory/2644-23-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2644-14-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2924-12-0x0000000000220000-0x0000000000281000-memory.dmp

Filesize
388KB

Download
memory/2924-11-0x0000000000220000-0x000000000026A000-memory.dmp

Filesize
296KB

Download
memory/2924-5-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2924-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2924-10-0x0000000000220000-0x000000000026A000-memory.dmp

Filesize
296KB

Download
memory/2924-26-0x0000000000220000-0x0000000000281000-memory.dmp

Filesize
388KB

Download
memory/2924-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2924-36-0x0000000000220000-0x0000000000281000-memory.dmp

Filesize
388KB

Download
memory/2924-38-0x0000000000220000-0x0000000000281000-memory.dmp

Filesize
388KB

Download