Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 13:13
Static task
static1
Behavioral task
behavioral1
Sample
08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
08b8e52932646b3fc2b1d62388c0e297
-
SHA1
585048824812aa5a4c93be172e30cbab3e8cb5db
-
SHA256
b249c785134ea16775fdb446830e0f42a94bebd4ed80470a0f9ece13fe6b04a2
-
SHA512
8e7f1e0d54af8ee6d853ce606a152826fc384177f2f52d131a083b16b74b449a9e0d18dfbdbf59f6fcd3262fd7f3a557e89e421899f4a00ed85903d8e79d5de6
-
SSDEEP
12288:QjJzCZH8Yz0f3XjhVZnQn5K+JOsFnIjleTsfI9ykLvcF3pppppppb+u6WXncq4z9:QjJ/fX9fQ05sFIjMTy1kLacJqcvko
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2444 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Wplugin.dll 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe File opened for modification C:\Windows\Wplugin.dll 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe File created C:\Windows\explorer.exe.local 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe File created C:\Windows\ws2help.dll 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe File opened for modification C:\Windows\ws2help.dll 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2444 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2444 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe 2444 08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08b8e52932646b3fc2b1d62388c0e297_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD58847a8302dacc1d6fca61f125c8fe8e0
SHA1f399142bbf03660bee1df555ebbf3acc8f658cf0
SHA2569c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943
SHA5122b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f