Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 19:58

General

  • Target

    81bc4902746ed2a82a8ba5b589a6f18d_JaffaCakes118.exe

  • Size

    320KB

  • MD5

    81bc4902746ed2a82a8ba5b589a6f18d

  • SHA1

    0a4afc23489a2fe40db28dae42821122ac8f8086

  • SHA256

    24b5991e9198a2c3650fb4d1f8299c1ca1c78036be190ad619638cab22fafdfc

  • SHA512

    7af0268e0386a0b0f274bb6d5c210f11db4289c0cbf3a6d3f39c67ac11d4ead1e3f8584a697e4d90b584bf70d3b0b9e5f640be424c7ce7a515dd21c414947860

  • SSDEEP

    6144:FMBMXBfEpLjJelc/dV3CImWhJMtC7LvaSXG+duyNrPjEOMlqKVeWzYq:FW+BwZIe/3CImmqtwjaLQuEEOhKVee

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81bc4902746ed2a82a8ba5b589a6f18d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\81bc4902746ed2a82a8ba5b589a6f18d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs4BCE.tmp

    Filesize

    608KB

    MD5

    5be8e7b258edda04e391c84db14b9ff9

    SHA1

    756cfef5c16ff7151ac1c23a33b723c1d1ae5e95

    SHA256

    9a4ca20198209ab3a4bcae2cf1882242ac1e47ca4c25d08e961f23f50ff8b343

    SHA512

    ab1036f51403ed9c2f6aa9f39f095c9362d2e85c33f6b006d374e2f17ff55aab9d8400d0ef8b14b843f64a31aeee7267e8130cebc183de8dbdd3265f5bab4021

  • memory/1680-11-0x00000000747C0000-0x0000000074F70000-memory.dmp

    Filesize

    7.7MB

  • memory/1680-13-0x00000000747C0000-0x0000000074F70000-memory.dmp

    Filesize

    7.7MB

  • memory/1680-1-0x0000000000720000-0x0000000000723000-memory.dmp

    Filesize

    12KB

  • memory/1680-7-0x0000000004B40000-0x0000000004BDE000-memory.dmp

    Filesize

    632KB

  • memory/1680-8-0x0000000002630000-0x000000000263A000-memory.dmp

    Filesize

    40KB

  • memory/1680-9-0x0000000005640000-0x0000000005BE4000-memory.dmp

    Filesize

    5.6MB

  • memory/1680-3-0x00000000747CE000-0x00000000747CF000-memory.dmp

    Filesize

    4KB

  • memory/1680-10-0x0000000005130000-0x00000000051C2000-memory.dmp

    Filesize

    584KB

  • memory/1680-12-0x00000000050C0000-0x00000000050CA000-memory.dmp

    Filesize

    40KB

  • memory/1680-0-0x0000000000040000-0x000000000010D000-memory.dmp

    Filesize

    820KB

  • memory/1680-14-0x00000000747C0000-0x0000000074F70000-memory.dmp

    Filesize

    7.7MB

  • memory/1680-15-0x00000000083C0000-0x0000000008426000-memory.dmp

    Filesize

    408KB

  • memory/1680-16-0x00000000747C0000-0x0000000074F70000-memory.dmp

    Filesize

    7.7MB

  • memory/1680-25-0x0000000000040000-0x000000000010D000-memory.dmp

    Filesize

    820KB

  • memory/1680-26-0x00000000747CE000-0x00000000747CF000-memory.dmp

    Filesize

    4KB

  • memory/1680-27-0x00000000747C0000-0x0000000074F70000-memory.dmp

    Filesize

    7.7MB