Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 13:45

General

  • Target

    309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll

  • Size

    217KB

  • MD5

    309eeb2402c0d04705a6ef03eb090d94

  • SHA1

    cd6d455f1b8b9b5ea37f1e5f01116ace3df533bf

  • SHA256

    30a850f0573522006ff29ba6972e316b8c58ccad96b8da295518906f64254a58

  • SHA512

    abcea6f1ff9597f8a3c06aaea2fd5c4fa1d991465de25fe10b4c184bc2c950de402db3b62e5fb1affe9d5752c1e1accbafe6f9668cf6bd5a25a2be85c86af795

  • SSDEEP

    384:ogaUwAW/SGoUPWhS3YzXv0ysk3dI1gNi/rKUQYd61fIBC:TwAaSGoUPWo3iv8kNIgY/+Tt

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll,#1
      2⤵
        PID:3772

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3772-0-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB