c88a21a5af290ad81695bca79c3dbc2eedf0d35b307d208cc6cfe531cdb0e50b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
Size

350KB
MD5

59f5b5b38268cf2a7c345d6cc3f8f303
SHA1

39b898873c2a32f05b82617e88018118dc33be3f
SHA256

c88a21a5af290ad81695bca79c3dbc2eedf0d35b307d208cc6cfe531cdb0e50b
SHA512

686711fd57a235a1a94204b5ffb12d33dfa6f2df9995a25754d67a6b5646489ae522a1b9d7ba32c4a9f090fc1340d9917819785da73544a84185396c0e3bfacb
SSDEEP

6144:Pvd/T0yclQcvohI8e7xYJSpctM0v66CLj+W9RvGdQPSMDrpy03Trdexgw:PF70HpSI8elUv66y6W9lG2znpTjIB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1132	1C9B.tmp

Loads dropped DLL 2 IoCs

pid	Process
2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1132	2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	97
PID 2084 wrote to memory of 1132	2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	97
PID 2084 wrote to memory of 1132	2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	97
PID 2084 wrote to memory of 4684	2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	98
PID 2084 wrote to memory of 4684	2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	98
PID 2084 wrote to memory of 4684	2084	59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\1C9B.tmp
  C:\Users\Admin\AppData\Local\Temp\1C9B.tmp
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\59f5b5b38268cf2a7c345d6cc3f8f303_JaffaCakes118.exe" --cp "C:\Users\Admin\AppData\Local\Temp\1CAC.tmp"
  2⤵
  PID:4684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1C9B.tmp

Filesize
294KB

MD5
f6bc9553546d35afa1ecf723f72ebad2

SHA1
586557e9a1789d6b7751f0bdf5b842d0e8c791a7

SHA256
2f00f38558a81f10bf7337c5548bc1fd69d2b555b8dba364715574af1f040836

SHA512
e85c5ba1991cfbacff4dca8151553ad1eed3f84394ec5b15fdf432ea98ed526debba11f6b95a568c92e77d7e1531318970a8759b704d0ca40e75277c6621048e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CAC.tmp

Filesize
350KB

MD5
9da2c61ac19989a09215401ae3200f1f

SHA1
b7cce09c240a4ef32d5c079195125c786c09901f

SHA256
4685f8630ec6dbb6ccfd1c41784d12aec9f05f5bf446529b946de9d08c9e0312

SHA512
c7e0d1603c055bbd4c6fd2b724340dae13a19f3e096e4ad055409651d0ae98302aa48e1b9bec2442b69ccabd15f382aea91e54be84db8357780fb494a2c8b9d2

Download Submit
memory/1132-7-0x0000000000400000-0x0000000000449810-memory.dmp

Filesize
294KB

Download
memory/1132-22-0x0000000000400000-0x0000000000449810-memory.dmp

Filesize
294KB

Download
memory/2084-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2084-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2084-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2084-20-0x0000000000670000-0x00000000006D1000-memory.dmp

Filesize
388KB

Download
memory/2084-31-0x0000000000670000-0x00000000006D1000-memory.dmp

Filesize
388KB

Download
memory/2084-34-0x0000000000670000-0x00000000006D1000-memory.dmp

Filesize
388KB

Download
memory/4684-8-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4684-14-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download