Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 18:59

General

  • Target

    72efe6a818cee293c6c246d75ca5af98_JaffaCakes118.exe

  • Size

    283KB

  • MD5

    72efe6a818cee293c6c246d75ca5af98

  • SHA1

    ff7def81e20e135f4ee32cc681210c6202bdd055

  • SHA256

    cb8eb994f329ad607fb648f57be1654bcf28d0a56aee469b775e8ebf148addcf

  • SHA512

    29e22fb5f2645e28b90d3c041883290ecf1571825c49b05534a26703187750e4c947e084718a6e17f5418a966835531407ed08a84dd74576971bd1ac87b12c6d

  • SSDEEP

    6144:Pw6JOerGp2aPeiyx+/Hqyo3ia/keIJSkH364n8LQTj3Fv0B2fgYIt:PwurYPex+/2rXI5XxBj3GMf0t

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72efe6a818cee293c6c246d75ca5af98_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\72efe6a818cee293c6c246d75ca5af98_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs62F0.tmp

    Filesize

    496KB

    MD5

    93fde31f598bbfb7b0822648d4a83889

    SHA1

    9b7194bbdcee2ed5ee95769a79e44dcb1c848944

    SHA256

    2bcf933a8542f0df471a459e3a37408c1209fbe367bcd738e7d7a1700a36f983

    SHA512

    ee6ba0aafe8b2830ff5f8986be652f097f65632252abd55abefa4fd2e4269afdd62387ea5faff110da77463418b2e4406d5a3dc1ac7c884b7f676bff4b4e07cf

  • memory/5104-11-0x00000000058F0000-0x0000000005982000-memory.dmp

    Filesize

    584KB

  • memory/5104-14-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/5104-2-0x0000000000EE0000-0x0000000000EE3000-memory.dmp

    Filesize

    12KB

  • memory/5104-7-0x00000000053C0000-0x0000000005442000-memory.dmp

    Filesize

    520KB

  • memory/5104-8-0x0000000001710000-0x000000000171A000-memory.dmp

    Filesize

    40KB

  • memory/5104-10-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/5104-9-0x0000000005E00000-0x00000000063A4000-memory.dmp

    Filesize

    5.6MB

  • memory/5104-0-0x0000000000F50000-0x000000000100A000-memory.dmp

    Filesize

    744KB

  • memory/5104-3-0x000000007495E000-0x000000007495F000-memory.dmp

    Filesize

    4KB

  • memory/5104-12-0x00000000058B0000-0x00000000058BA000-memory.dmp

    Filesize

    40KB

  • memory/5104-13-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/5104-15-0x0000000008D10000-0x0000000008D76000-memory.dmp

    Filesize

    408KB

  • memory/5104-16-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB

  • memory/5104-25-0x000000000B020000-0x000000000B7C6000-memory.dmp

    Filesize

    7.6MB

  • memory/5104-26-0x0000000000F50000-0x000000000100A000-memory.dmp

    Filesize

    744KB

  • memory/5104-27-0x0000000000EE0000-0x0000000000EE3000-memory.dmp

    Filesize

    12KB

  • memory/5104-28-0x000000007495E000-0x000000007495F000-memory.dmp

    Filesize

    4KB

  • memory/5104-29-0x0000000074950000-0x0000000075100000-memory.dmp

    Filesize

    7.7MB