daac4d73224f384f1cbfbe6ed8aac201fea29a086ea6f57283e0b92d68791930 | Triage

Submit
Reports

Overview

overview

Static

static

3

43815ba4a6...18.exe

windows7-x64

43815ba4a6...18.exe

windows10-2004-x64

$TEMP/Predecease.dll

windows7-x64

$TEMP/Predecease.dll

windows10-2004-x64

$TEMP/book...60.dll

windows7-x64

1

$TEMP/book...60.dll

windows10-2004-x64

1

$TEMP/book...60.dll

windows7-x64

1

$TEMP/book...60.dll

windows10-2004-x64

1

$TEMP/book...PN.dll

windows7-x64

1

$TEMP/book...PN.dll

windows10-2004-x64

1

$TEMP/book...pc.exe

windows7-x64

1

$TEMP/book...pc.exe

windows10-2004-x64

1

$TEMP/book...de.dll

windows7-x64

1

$TEMP/book...de.dll

windows10-2004-x64

1

$TEMP/book...in.exe

windows7-x64

1

$TEMP/book...in.exe

windows10-2004-x64

1

$TEMP/book...es.dll

windows7-x64

1

$TEMP/book...es.dll

windows10-2004-x64

1

$TEMP/list...60.dll

windows7-x64

1

$TEMP/list...60.dll

windows10-2004-x64

1

$TEMP/list...st.dll

windows7-x64

1

$TEMP/list...st.dll

windows10-2004-x64

1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 23:14

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

43815ba4a61004342ca9023ad2865a57_JaffaCakes118.exe

Resource

win7-20231129-en

lokibot collection spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

43815ba4a61004342ca9023ad2865a57_JaffaCakes118.exe

Resource

win10v2004-20240508-en

lokibot collection spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

$TEMP/Predecease.dll

Resource

win7-20240215-en

lokibot spyware stealer trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

$TEMP/Predecease.dll

Resource

win10v2004-20240508-en

lokibot collection spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral5

Sample

$TEMP/bookmark/thanks/69.opends60.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

$TEMP/bookmark/thanks/69.opends60.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

$TEMP/bookmark/thanks/79.opends60.dll

Resource

win7-20240220-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

$TEMP/bookmark/thanks/79.opends60.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

$TEMP/bookmark/thanks/MFC80JPN.dll

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

$TEMP/bookmark/thanks/MFC80JPN.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

$TEMP/bookmark/thanks/cert2spc.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

$TEMP/bookmark/thanks/cert2spc.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

$TEMP/bookmark/thanks/crtowordsde.dll

Resource

win7-20240508-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

$TEMP/bookmark/thanks/crtowordsde.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

$TEMP/bookmark/thanks/editbin.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

$TEMP/bookmark/thanks/editbin.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

$TEMP/bookmark/thanks/interfaces.dll

Resource

win7-20240220-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

$TEMP/bookmark/thanks/interfaces.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

$TEMP/list_users/4.opends60.dll

Resource

win7-20240215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

$TEMP/list_users/4.opends60.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

$TEMP/list_users/IEHost.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

$TEMP/list_users/IEHost.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

$TEMP/bookmark/thanks/cert2spc.exe
Size

8KB
MD5

15d14d0403243f2939389b50e62a5d9c
SHA1

29ca8ad75a159cf8740f21f8e1a2649abf81589e
SHA256

c25f774434af1c494594d8315ca8cfd12257c53b8e3682e626b230b79dd5a863
SHA512

83f0b6074911f4f8fc74d556537c9a8a1999cfbf5b8dedd97a9b5824d3b3bc39b7e8b876e5aa68a9eb597ac89ccaba9a516df21446200aa172994718c62a1ead
SSDEEP

192:nuF8MV0BxUAOW/3m3tGdqhIEg0YHvWCcqoS/W5e:n+8MVA1S3txg0avW1xS/W5e

Score

1^/10

Malware Config

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\bookmark\thanks\cert2spc.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\bookmark\thanks\cert2spc.exe"
1⤵
PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy