9f4ba63d625edf65126578e7eeae7a338633038750ed96088d6f6e53b6a21c5b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
Size

325KB
MD5

63eba9fddbe18dfe88428445c546576b
SHA1

090dcf2222df2867ad27207f0c7774027cfc78df
SHA256

9f4ba63d625edf65126578e7eeae7a338633038750ed96088d6f6e53b6a21c5b
SHA512

797efa45b7ffff16079edcc45a6dc926fac31ffa9da6420a79a87c2cdace92daccf59849145c3ae3cc50928c31a670abb805e0452f32458cdcaa84a8dc57b3ea
SSDEEP

6144:qrl8sf608N/cz9GD0mOh3Jhh9Ha24RYEq:yl8sC08N89StOh4lq

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

pid process

2060 63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
2060 63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2060 63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

pid process

2060 63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
2060 63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

pid	process
2060	63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
2060	63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2060	63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

pid	process
2060	63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
2060	63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63eba9fddbe18dfe88428445c546576b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bhs48D0.tmp
Filesize
241KB

MD5
d70cbeebf027958b345d7a8c5f58bae9

SHA1
9e98d6fcb9e4a5119cf345e752f38ab013094775

SHA256
a41a9fefe9b545590af058111930503ec52babc6c8e22b856810dbe980a37359

SHA512
88a50f0a3edfb99b18089cb3f3f6e03ce6cbd164f6ad19405fde82aca18c62af617509e31ded26ae58f19cacb950b139443fabbfb179e43681845ad85f2b3d35

Download Submit
memory/2060-7-0x00000000051F0000-0x00000000051FA000-memory.dmp

Filesize
40KB

Download
memory/2060-3-0x0000000002D40000-0x0000000002D82000-memory.dmp

Filesize
264KB

Download
memory/2060-4-0x0000000005A40000-0x0000000005FE4000-memory.dmp

Filesize
5.6MB

Download
memory/2060-5-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2060-6-0x0000000005330000-0x00000000053C2000-memory.dmp

Filesize
584KB

Download
memory/2060-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/2060-8-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2060-9-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2060-10-0x0000000008AF0000-0x0000000008B56000-memory.dmp

Filesize
408KB

Download
memory/2060-11-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/2060-17-0x000000000AB20000-0x000000000B2C6000-memory.dmp

Filesize
7.6MB

Download
memory/2060-21-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/2060-22-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads