Analysis
-
max time kernel
126s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
11-04-2024 08:09
General
-
Target
ecf55422e419162d13d311df5560c939_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
ecf55422e419162d13d311df5560c939
-
SHA1
d198da34c100d5ac19b9989e04f2196c25b8588d
-
SHA256
75779a5a395a747bafd0004877b7da03b8a98a8183debd69efcfe9fc383c5aa8
-
SHA512
9b14460ea72def9c049b9b24464c3bf9723f31cc4985d30e551750d3078001e51288a0e304999c7268126546d0ad29453d3d5d316516b8447ac17e46e5cb0aa2
-
SSDEEP
12288:9fHnu1hxBOwTdG7MDsDbQg779SweGIvdZOyjGU+G0VCspXMl3A6Gnzq9PBa8nT7:pHK3OwTd8MQDbQgHgUIv1jGUXuCs9qb
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
104.248.170.50
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ecf55422e419162d13d311df5560c939_JaffaCakes118.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecf55422e419162d13d311df5560c939_JaffaCakes118.dll,DllRegisterServer {F798AFE7-118A-4581-8E3E-E892DC5D6B28}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB