Analysis

  • max time kernel
    143s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 23:59

General

  • Target

    5c29fe6a6b86554447f01b84180bd5d3_JaffaCakes118.exe

  • Size

    334KB

  • MD5

    5c29fe6a6b86554447f01b84180bd5d3

  • SHA1

    f20e2a58b815bcdb7a8dfba0e47107268f3362f1

  • SHA256

    d7eccf695505f72e0ad2cbf266eadf6f2441fc21d5e58f5847ddafe48856554d

  • SHA512

    9d7de70ac75c9e6731048e29e1d3b5f007ae74c18846b214e351ad6e772feb47dcbdd4dd2f64d277ca5840124f5335e62b8bea6f527106ad6957b92bc3d96bab

  • SSDEEP

    6144:UnyswfWCVUP89jgiqUP8tucUpCL/W1qQmMJZRESeGuz3V8AbSY5Q:UyJfzVj9PqUozi2W1vmWZRbijQ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c29fe6a6b86554447f01b84180bd5d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c29fe6a6b86554447f01b84180bd5d3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bhs3CBB.tmp

    Filesize

    259KB

    MD5

    6079171ee93812a5b89afa3a92f6fee3

    SHA1

    7662e979b2c6b042af377f757a84ab6e87d72351

    SHA256

    978ada3bdbdc831f9a48db57e8c2085f651106b5402c90b6017787dc454e12dc

    SHA512

    2d7af0d0db257bd7c1c0a35296c642c7ccba2a4515fdc17e55f6bf11730f1feacd761aef710e300d0d58879f759cf984ec97f148acb91998e1ce998f7240d06d

  • memory/4152-7-0x0000000007430000-0x000000000743A000-memory.dmp

    Filesize

    40KB

  • memory/4152-3-0x0000000004FA0000-0x0000000004FE6000-memory.dmp

    Filesize

    280KB

  • memory/4152-4-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/4152-5-0x00000000078E0000-0x0000000007E84000-memory.dmp

    Filesize

    5.6MB

  • memory/4152-6-0x0000000007260000-0x00000000072F2000-memory.dmp

    Filesize

    584KB

  • memory/4152-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

    Filesize

    4KB

  • memory/4152-8-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/4152-9-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/4152-10-0x0000000008F70000-0x0000000008FD6000-memory.dmp

    Filesize

    408KB

  • memory/4152-11-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/4152-20-0x000000000C8A0000-0x000000000D046000-memory.dmp

    Filesize

    7.6MB

  • memory/4152-21-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

    Filesize

    4KB

  • memory/4152-22-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB