Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 09:23

General

  • Target

    a4d4c61ebcee98d1913665dcfb6a52ae_JaffaCakes118.exe

  • Size

    293KB

  • MD5

    a4d4c61ebcee98d1913665dcfb6a52ae

  • SHA1

    2df6e66955024a3ca4072b76acad4f54050202d6

  • SHA256

    10a6ccd07faf1a68e3626db66fb496519d5481c729253460a9a7ffd6642612ac

  • SHA512

    7aed07f3032a3160c1b65a92884d94462f682626eed621b441fa6afb97b8e4c2d1780fbfd740e5659e14dfa457214e2b3c1950bc609b4b7e6df0aeb2b8338847

  • SSDEEP

    6144:mrVJ+6Y0JQBkQRl7174NpNUM+UHs+ZIm//QFwhV1yAuz/IbsoNaQqj0C5xb:mrVk63yRl1uqM+gs+ZIm/IFwT2zuHY0y

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4d4c61ebcee98d1913665dcfb6a52ae_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4d4c61ebcee98d1913665dcfb6a52ae_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\TsuA93A2144.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{C0D992CE-AAD1-4B0D-A9E6-E2F31B3AB038}\Custom.dll

    Filesize

    60KB

    MD5

    0f44d43090e1e6784224ff618ce709ff

    SHA1

    1dd769d04e61e44ad3caf3aa28eb39b466477b34

    SHA256

    93089adb588d7fd316e2d0ee6cb0b06bc92a314f5c90000f9515c87d635d2221

    SHA512

    0eb3115652bc25bf981ad7edda4cb006fed41b080ea50b63011ccf0c13ebfe4a076af3dfc72caeb8f33f38e96ed92308c0ba367dc17db08ee46ea7c4b5c0207c

  • \Users\Admin\AppData\Local\Temp\{C0D992CE-AAD1-4B0D-A9E6-E2F31B3AB038}\_Setup.dll

    Filesize

    153KB

    MD5

    f16ac5e1a96d31a997a6e4c8f1adae0c

    SHA1

    c8b035cc4cc66172538dfdd115d1804afef357c9

    SHA256

    044a8ac9085c3f5524817d8dbd0ade4d43b9ab72978e15e61fdf8b00b68f69cc

    SHA512

    35b2259c77e4e5c96657446b402cf1075dfd2e9c2d80029cc26ce796c8beb27a403917bbdef98760409ec0ea2afbbf853642638b0ea31e0166c1d29b6e4206e5