Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 16:14

General

  • Target

    63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

  • Size

    325KB

  • MD5

    63eba9fddbe18dfe88428445c546576b

  • SHA1

    090dcf2222df2867ad27207f0c7774027cfc78df

  • SHA256

    9f4ba63d625edf65126578e7eeae7a338633038750ed96088d6f6e53b6a21c5b

  • SHA512

    797efa45b7ffff16079edcc45a6dc926fac31ffa9da6420a79a87c2cdace92daccf59849145c3ae3cc50928c31a670abb805e0452f32458cdcaa84a8dc57b3ea

  • SSDEEP

    6144:qrl8sf608N/cz9GD0mOh3Jhh9Ha24RYEq:yl8sC08N89StOh4lq

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bhs48D0.tmp

    Filesize

    241KB

    MD5

    d70cbeebf027958b345d7a8c5f58bae9

    SHA1

    9e98d6fcb9e4a5119cf345e752f38ab013094775

    SHA256

    a41a9fefe9b545590af058111930503ec52babc6c8e22b856810dbe980a37359

    SHA512

    88a50f0a3edfb99b18089cb3f3f6e03ce6cbd164f6ad19405fde82aca18c62af617509e31ded26ae58f19cacb950b139443fabbfb179e43681845ad85f2b3d35

  • memory/2060-7-0x00000000051F0000-0x00000000051FA000-memory.dmp

    Filesize

    40KB

  • memory/2060-3-0x0000000002D40000-0x0000000002D82000-memory.dmp

    Filesize

    264KB

  • memory/2060-4-0x0000000005A40000-0x0000000005FE4000-memory.dmp

    Filesize

    5.6MB

  • memory/2060-5-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/2060-6-0x0000000005330000-0x00000000053C2000-memory.dmp

    Filesize

    584KB

  • memory/2060-0-0x000000007495E000-0x000000007495F000-memory.dmp

    Filesize

    4KB

  • memory/2060-8-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/2060-9-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/2060-10-0x0000000008AF0000-0x0000000008B56000-memory.dmp

    Filesize

    408KB

  • memory/2060-11-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/2060-17-0x000000000AB20000-0x000000000B2C6000-memory.dmp

    Filesize

    7.6MB

  • memory/2060-21-0x000000007495E000-0x000000007495F000-memory.dmp

    Filesize

    4KB

  • memory/2060-22-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB