Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 09:45

General

  • Target

    19ac9d494ebe1896b9b09ac207021c18_JaffaCakes118.exe

  • Size

    3.7MB

  • MD5

    19ac9d494ebe1896b9b09ac207021c18

  • SHA1

    6aa56f17657b58b00fd1ec8aff499d09545af467

  • SHA256

    cf73cbca469932dabd9410cdcf40abb3b242995630ef6c0bdbdba1161f19ae14

  • SHA512

    f302afc9446aa044a47ef93a0212c98a32dc1715428cd5bd83e447b55cd6cf7a74a86045eec7f94f8e2d6cc6b106fd92403bd4a558c613ec84e2deb011776f42

  • SSDEEP

    98304:Tq4TOs5GAPuWzsbhTRpzsGVD4YMBqtAxC:Tq4aCEbTpIGVsqm8

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19ac9d494ebe1896b9b09ac207021c18_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\19ac9d494ebe1896b9b09ac207021c18_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e575886.tmp

    Filesize

    1.6MB

    MD5

    4f3387277ccbd6d1f21ac5c07fe4ca68

    SHA1

    e16506f662dc92023bf82def1d621497c8ab5890

    SHA256

    767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

    SHA512

    9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

  • C:\Users\Admin\AppData\Local\Temp\e575897.tmp

    Filesize

    1.6MB

    MD5

    5870ea0d6ba8dd6e2008466bdd00e0f4

    SHA1

    d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5

    SHA256

    5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d

    SHA512

    0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837

  • C:\Users\Admin\AppData\Local\Temp\e5758a7.tmp

    Filesize

    137KB

    MD5

    f6b847a54cfb804a25b8842b45fd1d50

    SHA1

    bb22fef07ce1577c8a7fa057d8cf05502c013bfc

    SHA256

    5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583

    SHA512

    dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a

  • memory/2044-1-0x00000000026A0000-0x00000000026FF000-memory.dmp

    Filesize

    380KB

  • memory/2044-0-0x0000000000400000-0x00000000008A7000-memory.dmp

    Filesize

    4.7MB

  • memory/2044-9-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-8-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/2044-7-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/2044-6-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/2044-5-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2044-4-0x0000000000A80000-0x0000000000A81000-memory.dmp

    Filesize

    4KB

  • memory/2044-3-0x0000000000A90000-0x0000000000A91000-memory.dmp

    Filesize

    4KB

  • memory/2044-2-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/2044-10-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-11-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/2044-16-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-23-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-22-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-21-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-20-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-19-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-18-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-17-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-15-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-14-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-13-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-12-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-24-0x00000000028A0000-0x00000000028A1000-memory.dmp

    Filesize

    4KB

  • memory/2044-46-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-45-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-44-0x0000000002730000-0x0000000002731000-memory.dmp

    Filesize

    4KB

  • memory/2044-43-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-42-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-41-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-40-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-39-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-38-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-37-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB

  • memory/2044-36-0x0000000002940000-0x0000000002941000-memory.dmp

    Filesize

    4KB

  • memory/2044-35-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/2044-34-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

  • memory/2044-33-0x0000000002900000-0x0000000002901000-memory.dmp

    Filesize

    4KB

  • memory/2044-32-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/2044-31-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/2044-30-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-29-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB

  • memory/2044-28-0x0000000002760000-0x0000000002761000-memory.dmp

    Filesize

    4KB

  • memory/2044-27-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/2044-26-0x0000000002740000-0x0000000002741000-memory.dmp

    Filesize

    4KB

  • memory/2044-25-0x0000000002750000-0x0000000002751000-memory.dmp

    Filesize

    4KB

  • memory/2044-47-0x0000000000400000-0x00000000008A7000-memory.dmp

    Filesize

    4.7MB

  • memory/2044-50-0x0000000003780000-0x0000000003781000-memory.dmp

    Filesize

    4KB

  • memory/2044-160-0x0000000000400000-0x00000000008A7000-memory.dmp

    Filesize

    4.7MB

  • memory/2044-162-0x00000000026A0000-0x00000000026FF000-memory.dmp

    Filesize

    380KB

  • memory/2044-163-0x0000000003790000-0x0000000003791000-memory.dmp

    Filesize

    4KB