Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 09:57

General

  • Target

    eacdfd63d15e6200189baeaad8d2020e_JaffaCakes118.exe

  • Size

    29KB

  • MD5

    eacdfd63d15e6200189baeaad8d2020e

  • SHA1

    34b74f91efa8ce6065aee12c7754c4bc3f7d0287

  • SHA256

    3c2cc9a7711c72b96ce27a85b0ee6f8514541939e4734199226c424781e464a4

  • SHA512

    1625be270e97c7276c7b65cae159a792ee8aca7faddfe52a7be3efba921713c0247eef95a27151a1b4e81ef36aed00db1197cfd95d510303019f73b67d246820

  • SSDEEP

    768:AjndTHeBKETJ3aFVPhzp5HW9VIx7Uu2+UVR:Aj5HnA4XpX8yxb2+mR

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eacdfd63d15e6200189baeaad8d2020e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eacdfd63d15e6200189baeaad8d2020e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat

    Filesize

    42KB

    MD5

    4ac70e5d0fc9b4976ecf524d2e5547c9

    SHA1

    4da174c8ec080b4f7fd28dc3d3a3366b729f2aa1

    SHA256

    0c361b6e4be80e6db6b78903d1ea064443ba18ad44b6c66ced3eb5780fe41591

    SHA512

    bbfa8994bad6684bf16ab3cc4382d655e9a7c47c7aee64f393c20107712d874ea6c7b40f993e1685601f0433cd377b1c5a45cf8c23f67563e2f78af2b9960b77

  • memory/5012-0-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/5012-7-0x0000000000AC0000-0x0000000000AD4000-memory.dmp

    Filesize

    80KB

  • memory/5012-10-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/5012-11-0x0000000000AC0000-0x0000000000AD4000-memory.dmp

    Filesize

    80KB