Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
14/05/2024, 05:05
General
-
Target
3df9d097dca6251f1db07bf42785b4bd_JaffaCakes118.exe
-
Size
13.3MB
-
MD5
3df9d097dca6251f1db07bf42785b4bd
-
SHA1
ac65ef39885ff2d8049360493a4e8e26efc59902
-
SHA256
d6d37cb6de81f781b0fa1cdb0b308173bf0e6da73663011e8ca42ecd8e625652
-
SHA512
a31b950f64ee0f35e74fea8dcdd69c9e6b249bfe59084b61468232542fec3f21ed6533f012ffad9365e4e429116880ce7aefb9791f5196d85e314181219455b7
-
SSDEEP
196608:dm82XlZWgTFzwq9Ief6GTD74W6PjKhRt96TGIAveSbMN6kH6/J/Zvgf3Tm+JCqKL:8TZTIeDTX2PjqtlIy35D74vT9Js6HlD6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df9d097dca6251f1db07bf42785b4bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3df9d097dca6251f1db07bf42785b4bd_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TempÇý¶¯°²×°.exeC:\Users\Admin\AppData\Local\TempÇý¶¯°²×°.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD50eb708bd27e733a76d0a15415ffcaa35
SHA1e6b60b66462034ba329b6b7bb2f7c2c157758674
SHA25605375bf042c91d6164419d30e86ec5aee430360e948427bcb58e87413bc3a433
SHA5128b032fb189cc2d897ac9d257567c34cd8f7918acde8bd3249d601681ebfdbdbd1f883528b50c3dfeb88bfe240ceb87d5bf9429ba2ba1b0f4bdbbadc5ac8e7462
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB