Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10/06/2024, 13:26
General
-
Target
9acf9fb3e9b149194bcd2f2b70c79ebf_JaffaCakes118.exe
-
Size
759KB
-
MD5
9acf9fb3e9b149194bcd2f2b70c79ebf
-
SHA1
e9a761b3e140e8e2004690be8d6ce2b780c2ac7c
-
SHA256
11b2877aee2f34b668956082266332e1a6f660c645ba450fa2bce9d1a01a5b73
-
SHA512
00f0561834f373756852714643cdad38bea9f0821ae532687428f07c6f9e830192cc398cb6adb03e729af806d2d86cc54e3e3fb5232b8c0235ed16c4455ffba7
-
SSDEEP
12288:xp4xDfr5AsTKV4gZMjHkU+aNiRqtvQ9N0gYzj9+TAYrUaGRrBNvEuAgVaRdLuVsY:xpIDPTY48Mr5wqt48gYxmUas1NvEuAgj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 10 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 50 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9acf9fb3e9b149194bcd2f2b70c79ebf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9acf9fb3e9b149194bcd2f2b70c79ebf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 14483⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
759KB
MD59acf9fb3e9b149194bcd2f2b70c79ebf
SHA1e9a761b3e140e8e2004690be8d6ce2b780c2ac7c
SHA25611b2877aee2f34b668956082266332e1a6f660c645ba450fa2bce9d1a01a5b73
SHA51200f0561834f373756852714643cdad38bea9f0821ae532687428f07c6f9e830192cc398cb6adb03e729af806d2d86cc54e3e3fb5232b8c0235ed16c4455ffba7
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB