Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 02:25

General

  • Target

    65ae4ae766dd0ec7c73a45f876012b4c_JaffaCakes118.exe

  • Size

    227KB

  • MD5

    65ae4ae766dd0ec7c73a45f876012b4c

  • SHA1

    eddb22bd222ad34cbf44be46d53dc514c375ceab

  • SHA256

    7778da6c8103805d6f0163276408814fe6b30257bfb839add19cea7a49cd990a

  • SHA512

    1098a594e3b9ec37abed4fd27e2126f8caee263abc45fd0be9460de23f30239e8f222b4c39b98a54da92d6b72e7e118e5d43d81de0a4fc8fe90ebc061acce861

  • SSDEEP

    6144:U4lwZ40243s0gJvyTZaPYZeHF/tIzi+Tk98i9goc8VRtDkYC:7n0d8PJvyQYZelVIziveo/RtW

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65ae4ae766dd0ec7c73a45f876012b4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65ae4ae766dd0ec7c73a45f876012b4c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs4391.tmp

    Filesize

    344KB

    MD5

    5cfb0f8e32d3b9197bbb972bd374c381

    SHA1

    4c22e0d3b705cc55658af2cde5a62a899f513f90

    SHA256

    72ae74bf4b315a5ff9e1e7ac9a000b9b76df6492a9b1e830686c903b4b0c168a

    SHA512

    5c6c2a526dfc4ccea67a4db844c79e37d1012afa33bb9330d9c1f826ed1335c8c7f2b7bf98cd60a5625433f26a2a6cd48d279e3e32788fd1bf67ec972c9cee45

  • memory/4548-11-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-2-0x0000000000870000-0x0000000000873000-memory.dmp

    Filesize

    12KB

  • memory/4548-13-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-14-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-8-0x00000000010A0000-0x00000000010AA000-memory.dmp

    Filesize

    40KB

  • memory/4548-9-0x0000000005A60000-0x0000000006004000-memory.dmp

    Filesize

    5.6MB

  • memory/4548-10-0x0000000005400000-0x0000000005492000-memory.dmp

    Filesize

    584KB

  • memory/4548-0-0x00000000008A0000-0x000000000092B000-memory.dmp

    Filesize

    556KB

  • memory/4548-29-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-3-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

  • memory/4548-7-0x0000000002970000-0x00000000029CC000-memory.dmp

    Filesize

    368KB

  • memory/4548-16-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-15-0x00000000086F0000-0x0000000008756000-memory.dmp

    Filesize

    408KB

  • memory/4548-25-0x000000000AA10000-0x000000000B1B6000-memory.dmp

    Filesize

    7.6MB

  • memory/4548-26-0x00000000008A0000-0x000000000092B000-memory.dmp

    Filesize

    556KB

  • memory/4548-27-0x0000000000870000-0x0000000000873000-memory.dmp

    Filesize

    12KB

  • memory/4548-28-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

  • memory/4548-12-0x00000000053D0000-0x00000000053DA000-memory.dmp

    Filesize

    40KB