Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe
-
Size
380KB
-
MD5
ff8f1b8d21e63e0f2717accd373dcfec
-
SHA1
23817fab1ebc56d53b593132b48c6603a557da13
-
SHA256
e6600059395da08438f03ab84c0b196a06d506f3d10c1492a4ea7a6eea378646
-
SHA512
136c1e7119ce6f233a8006ed576a59a5922df2722df25f4d20dd21840e0b976ea3ba59b40f74c68980f121b7b895699163e76a3639359b042d3f770179d43c64
-
SSDEEP
6144:MgCMl4SUApom61F2idZecnl20lHRxp3gEncduD7yB9VCO6Sco4q8+dE6CqvFufV:Ms4EpHgF3Z4mxxXDqVTVOC49
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2156 ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\51B36E3D.dll ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\51B36E3D.dat ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\51B36E3D.dat ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\51B36E3D.dll ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Help\51B36E3D.chm ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe File opened for modification C:\Windows\Help\51B36E3D.chm ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2156 ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff8f1b8d21e63e0f2717accd373dcfec_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2156
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5ff8f1b8d21e63e0f2717accd373dcfec
SHA123817fab1ebc56d53b593132b48c6603a557da13
SHA256e6600059395da08438f03ab84c0b196a06d506f3d10c1492a4ea7a6eea378646
SHA512136c1e7119ce6f233a8006ed576a59a5922df2722df25f4d20dd21840e0b976ea3ba59b40f74c68980f121b7b895699163e76a3639359b042d3f770179d43c64
-
Filesize
41KB
MD5b9d531fd82d82f893a388ef6407cdee6
SHA1f167dad349caec44db06b56627ac576ee922bfd3
SHA25615825c6d0439d518737d07356f228d851b5c1073f250cfe86cf1a4d26b4a2d5e
SHA51291e802993eb70083b8fa0470920c63a1eb8b64cafc4f2a360e29dd1d41a948d5fdfd7e6a1c6ae63715097a6445c016b4124d6a47abe8502c4524ef8f6317fd6f