Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe
-
Size
952KB
-
MD5
01b77d82904490e6d639e7721a09f107
-
SHA1
cc27c91fe8a29b494984a3e366a5ba76ed234a87
-
SHA256
e16f3a67f080e3076f40f055193b098aab36e802b3a421c7c4d42f95195cd2a7
-
SHA512
6e4be5e2923d28fa034e0c4bd08de7dc0b3553fdb0510925b9b308cca6a8a0a987dd6c6ff3fd2ed66a73266180891298344e78a524e2af99a85405d1a8a6fd43
-
SSDEEP
24576:FILvZmb+BftUIcC0nCW1A3oyUlz9OLoZKXP:uZmb+BftDhsy4yy9tZK
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Win.ini 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe 2960 01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01b77d82904490e6d639e7721a09f107_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2960
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54edddb8d11fdf01f93a199a6bb861c60
SHA160fa89f62170db5be718bfdbb5b5a3bf4126d3fa
SHA2567c24e2d9aec077ed6d61b2c6cc07059cee43f30a4d58d93473836afd57a3b83c
SHA512bd7aa25fa88a1f0f8b5d2f3251fa5b334188f7863fbf89a7ca3eb83716d800ecedd5a75c07f1b972c4a63d8f6f1dc1686e6ff0b6c30377b25d7bad0a1b319e29