Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2024 06:06

General

  • Target

    d13ecbf3b1c307fe33151cdabdfe17fb_JaffaCakes118.exe

  • Size

    116KB

  • MD5

    d13ecbf3b1c307fe33151cdabdfe17fb

  • SHA1

    777427b503d4c5470a33f97e2de7358b419b6005

  • SHA256

    644bd3b744892ef98f9b55a0cf19b5663a6621d900a3b3dcb73414f68d0ba0bf

  • SHA512

    094e7a982a97c0a96f5751ce87f3d793eca7b9ffb9cfb7b5b5dd22210a58df112f8fc3122c3a8a672fa5d7b7aa94384e3a2f94d06232a9374c3d1732afd266dd

  • SSDEEP

    1536:VT1qQuydAaA7YL8e4Pq4Y9ADztCfSoEmMMyHpHat14gkqurzM3/:99hqg8iqpCfz6/qu3M3

Score
1/10

Malware Config

Signatures

  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\d13ecbf3b1c307fe33151cdabdfe17fb_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d13ecbf3b1c307fe33151cdabdfe17fb_JaffaCakes118.exe"
        2⤵
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2980

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1212-1-0x0000000002570000-0x0000000002579000-memory.dmp

      Filesize

      36KB

    • memory/1212-2-0x0000000002570000-0x0000000002579000-memory.dmp

      Filesize

      36KB

    • memory/2980-0-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/2980-5-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2980-4-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB