Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 06:20

General

  • Target

    039584401fe63d387cab2fd3956a8001_JaffaCakes118.exe

  • Size

    119KB

  • MD5

    039584401fe63d387cab2fd3956a8001

  • SHA1

    98eb8d32d8f20838eb88f285c1ea5b84abd4cb5c

  • SHA256

    bde6bd507c29fa42677c86f436ea8fe67c461053b0c17d4699f574d18e019b1b

  • SHA512

    82717cdfc759962831c82072646a3cea798e07a926bb1104acae8287431054994fa89b53822c286ee2b2081c2e3f26f5226bfff284ece9b0fdc0635210912ed8

  • SSDEEP

    3072:xoR17PL9SAPTusOJZsrWMhfilbiTiAT3wd/lnRHVff8gL:xoR1f9SeTuGW1t6TAd/lnR9

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\039584401fe63d387cab2fd3956a8001_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\039584401fe63d387cab2fd3956a8001_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\bcastdvr.prox.dll

    Filesize

    92KB

    MD5

    0ba31432867ff6d8894937742de8a9b4

    SHA1

    b8625730f74f37ca7f05e53e5a612a0f19775144

    SHA256

    c048c1f3efdaff60f6fda954fdeb3111b1e9473d1a3ab7e12eda13451b5b626e

    SHA512

    61b02c15b5d230af192583ade4ec4b231df2d0639a3f6bd69bee4309f5e2a632be2c90c02a5fa99835bbe1d16f35db6623454d463d42c5569c17e2082f96598b

  • memory/4124-0-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/4124-1-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB

  • memory/4124-6-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/4124-5-0x0000000000590000-0x00000000005D0000-memory.dmp

    Filesize

    256KB

  • memory/4124-4-0x0000000000590000-0x00000000005D0000-memory.dmp

    Filesize

    256KB

  • memory/4124-7-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/4124-9-0x0000000000590000-0x00000000005D0000-memory.dmp

    Filesize

    256KB