Analysis
-
max time kernel
1s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15-04-2024 20:23
Errors
Reason
Machine shutdown
General
-
Target
f1d9097da5a25704b82246e6a1530237_JaffaCakes118.dll
-
Size
38KB
-
MD5
f1d9097da5a25704b82246e6a1530237
-
SHA1
1a21d31df7941616cf6e2e3c7b790b2096ce3b4e
-
SHA256
f104ab345da41762fa5a07302859289e162fe197c2b1270f8f5d12354a670b5e
-
SHA512
d5f4ea9ad04dc7472c9ed1db54ff2ec570c89c53ea8374bf7da19f27ada0d7c766af457f953896d7fc62046d00a6df7a62d71ae36982b6939d75c34d2c6ae96d
-
SSDEEP
768:1Czs1U46clW4VbXoTS22idEzKfu/m+SyNtLrSSAcLCjXUZdr:eqsclW494TSr8EzKG/NdroU
Score
10/10
Malware Config
Signatures
-
Detect magniber ransomware 1 IoCs
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f1d9097da5a25704b82246e6a1530237_JaffaCakes118.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
8.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB