Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 16:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
-
Size
382KB
-
MD5
0ef3890b051c62c04435a5ab8cb15ec2
-
SHA1
c810007de17fe76f2fca134d0a1003c790a616d9
-
SHA256
b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b
-
SHA512
e56f43ae5a2c19f1e5b74ab5018821257aac3a5d94daa2c656d6181d33250acfed04f48d7bd678ab946d7eb48204760cb488a24f3503919b13ea7438bd1f2bc0
-
SSDEEP
6144:N3GXaEkS6acHhDbYIur4J4Zn4HSMz6gCz3FGIcAolpgVHMe4IuKKew8O/CTq:N4aW4uMz6DwAUOVHMe4938C
Malware Config
Extracted
Family
icedid
C2
wloppyload.top
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2920-3-0x0000000000760000-0x0000000000766000-memory.dmp IcedidFirstLoader behavioral1/memory/2920-6-0x0000000000750000-0x0000000000753000-memory.dmp IcedidFirstLoader -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exepid process 2920 0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe 2920 0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe