Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04-04-2024 14:03
General
-
Target
ba40d5aa9ba2419c25e7a0d8dfbb4600_JaffaCakes118.dll
-
Size
572KB
-
MD5
ba40d5aa9ba2419c25e7a0d8dfbb4600
-
SHA1
e3bfaaf32386553768022a086d95e83fa571741a
-
SHA256
ed0c061e3de7a017b87fab71f5b1d9e9fe8b8ac416e7d9840fd59d198b4869cb
-
SHA512
4216014bb9fb0f56577c500e705a2910c0be9ee099f9a33e6219d98bb10c2201a03e858a256196396af1e504f6412d0545d0246b7f54177d435efff32908a9d1
-
SSDEEP
6144:umUCbQC4Kd+yp5+H/OfQ1ezKfzEJ60vPeuG7T3VoOkcnwP1t6O/eVbnn6Y6726xV:bQC4KUkgH/Ofzy70vPfEQY675f2hIaYP
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
reddew28c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 5 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba40d5aa9ba2419c25e7a0d8dfbb4600_JaffaCakes118.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba40d5aa9ba2419c25e7a0d8dfbb4600_JaffaCakes118.dll,DllRegisterServer {06587EA4-2F78-499E-A725-B45E179FFDB4}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB