Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 10:47

General

  • Target

    b83710610898ba222d5691dcf6f4cda8_JaffaCakes118.exe

  • Size

    584KB

  • MD5

    b83710610898ba222d5691dcf6f4cda8

  • SHA1

    e3aba3e48ee04921890f46f33a595c66e364f72d

  • SHA256

    654363806ff054d685c96ff0baa1d232f3feebb770aa6ee55be38d83eb1aadfb

  • SHA512

    aafe382831450f7685cbe2ad192a7540800876a42db7ac82ef422726101b3d5cd9f1f56221a588bdd828085fe3f062e92bf38cd9f5b24ed4abf64896d094e300

  • SSDEEP

    12288:hk+vceJ2HfgG+26geCaZnZfeZ1g+3dNvd5zG6CBwbRGmLP7lmHZt:9vzeg7RWaNZS/3pT31Go8b

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b83710610898ba222d5691dcf6f4cda8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b83710610898ba222d5691dcf6f4cda8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\wc98pp.dll

    Filesize

    50KB

    MD5

    01ce67a8b8f546986309c28d4594d29c

    SHA1

    c375555e487481ba317af381d8f8524ab20defb0

    SHA256

    74bd7a4d90534a25f73b253c4cd21d8886b4c9d83c05a609f2bce91dfc3caf5c

    SHA512

    62654f5834909a8c20e29344ff2083fcdcdc9f2a29dc68cfe0f2374cd29fb8c5be2a50ea73632e66a408dea1f34e0f76f47c32400edbaa2fd066b2eded36f94a

  • memory/1384-0-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

  • memory/1384-5-0x0000000005040000-0x0000000005051000-memory.dmp

    Filesize

    68KB

  • memory/1384-10-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/1384-11-0x0000000005040000-0x0000000005051000-memory.dmp

    Filesize

    68KB

  • memory/1384-14-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB