Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 18:42

General

  • Target

    25d6b9d2b01f68ef2306543cac8111e8_JaffaCakes118.exe

  • Size

    108KB

  • MD5

    25d6b9d2b01f68ef2306543cac8111e8

  • SHA1

    bda76cd66a4b3ef6836dd2bc36fdff62e73f4efb

  • SHA256

    0cff7c419e0bc13a35293f2061fbbdf48c341d08b8ba4dc78faafe645a899eff

  • SHA512

    28c95a94a467af041b9a8e01a44d89443b409a2142832dd77b44b748b2d582d1006fcef7b2731bd251eed22aa03429b21d5d83f3d445e5de3291feee3c396a95

  • SSDEEP

    1536:uAqlzmQ49ikaaGzXzYZJgt8AfNaibTo0RiSGuuoGC8Ss32cT4:Zlika9QZut8Q3oQi7HU

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25d6b9d2b01f68ef2306543cac8111e8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\25d6b9d2b01f68ef2306543cac8111e8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\xyymgwnxqy.dll

    Filesize

    19KB

    MD5

    d60f69264a026611edf7ff094deacf1c

    SHA1

    3621bfefc8df97ad6fa3d01a8b747256d4cd0754

    SHA256

    dc5eef50e08e48c38e8621c88d89ee3f34d2112281eaee1d804999110a9857de

    SHA512

    2ea5e24f13e75a4fb342e6a04ce40e95b6d4e8f81392269b61f34926a0d7b81413723f91e4863c9519348376f084f29eadcbf1cc79b6c22aa8bdc0d4ca628ff0

  • memory/1636-3-0x00000000001B0000-0x00000000001CD000-memory.dmp

    Filesize

    116KB

  • memory/1636-5-0x00000000001B0000-0x00000000001CD000-memory.dmp

    Filesize

    116KB