Overview

overview

4

Static

static

3

13921ab213...18.exe

windows7-x64

4

13921ab213...18.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2024 13:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13921ab213a57096cedcf1ee625c5def_JaffaCakes118.exe

  • Size

    84KB

  • MD5

    13921ab213a57096cedcf1ee625c5def

  • SHA1

    88fad2bb0114d400435bfd7faf6b82d60eb77e1c

  • SHA256

    c25127e5b003fc3869237b8598be592ab08ee4a6a92b8216568839a594c8c799

  • SHA512

    7c6a4304db5d63573ccd515da7180c1b9fa330ad8765c02392f45c6383ac446500c3db7baf1aa5bcb45128ff19d87c4615ad1545423b744121cd99a0bdb3667c

  • SSDEEP

    1536:qwm8nBjqs32bxPpBRy32Z6gJlyiKqVo6EUI:5m8nBjTmbxRBRN6WYiKqVo6ZI

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\13921ab213a57096cedcf1ee625c5def_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\13921ab213a57096cedcf1ee625c5def_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2308

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1192-2-0x0000000002D70000-0x0000000002D71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2308-3-0x0000000013140000-0x000000001315B000-memory.dmp

      Filesize

      108KB

      Download