Analysis

  • max time kernel
    155s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 19:30

General

  • Target

    ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe

  • Size

    59KB

  • MD5

    ebd2eeb6c62f12f11f1575c74bbc1d6a

  • SHA1

    68259fbd1936268e78779f1634970d574d677a36

  • SHA256

    bc27f9ca4f1a712de85b14a5dc8c960cd5e7a155a5e4b82d1c902a9638991d2d

  • SHA512

    64dce2109a32dafb6d50c061e5aa421feea37deb1840ecb6846c1a970424bcf5c130c2409b1decf815f2914479973e50f5f52100c794ff42bd73db441cbf8eee

  • SSDEEP

    1536:RKSQdiVKKCdp/gc8O9Lj2K8tf+wZRKopW:85uKNdp/gD6YZ+AU5

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 3 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:2480
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k Runtime
    1⤵
    • Deletes itself
    • Loads dropped DLL
    PID:2132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\dgohgr.dll

    Filesize

    89KB

    MD5

    09a6c8caccd64da2bc0b022603754ed4

    SHA1

    6bc73f5f7d51098720c8d29c026ba6a859f7243e

    SHA256

    446d41b3eaf1d56db1226ce851e6f596aae780d2fc5dc458bfb24798ec7d79f6

    SHA512

    e8e14e57bdc4e8b91d881dc7203be87a7d5522cd92902451ed2beb90a56449fdf56aee68de7c72a2af9f48b30f15365084632fe6e588608810ca10535a7421d8

  • memory/2480-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2480-7-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB