Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 19:22

General

  • Target

    31a85cb2e2ed11b306bd816833c7b567_JaffaCakes118.exe

  • Size

    19KB

  • MD5

    31a85cb2e2ed11b306bd816833c7b567

  • SHA1

    0934a74deaf097b48ae4be998816b3dc410452de

  • SHA256

    09e362169ad4ab9aa42882302abcdbacad7a0f74c8e17b9f8bd3f2f31bb0dd70

  • SHA512

    ef15bd16cd42ea0d2229c93d1a26cd64c24719bbf69d25977b123ed97c6685d89ccab874ac18834fe87da4a2d1942caf7dd16cf4bedf9a9e414ee1f1f7065fc5

  • SSDEEP

    384:R68/+cw0IUZnYwx1wHtpOU3uvuoEy2/1cVp/WswD1KGqgJj3j:wS+AsNpy9iOpesw6OjT

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31a85cb2e2ed11b306bd816833c7b567_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\31a85cb2e2ed11b306bd816833c7b567_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\31a85cb2e2ed11b306bd816833c7b567_JaffaCakes118ow.dll

    Filesize

    15KB

    MD5

    36b9ec62e1c2f0c309f28ba990f11450

    SHA1

    795e38fa6af1e8ffe906e98d26a67d4cca942960

    SHA256

    b347a93fd2aee6de81ddb55e0db1c53f1039da1360c87f3a69bab9773dbee6ac

    SHA512

    37763dde7e444a6165a78fd377e172a8cb61986b86c425e6a7054303170a7b2b9988cc99c32a5265ca576e130ba66c563af145471c7d15816e5ceb75d9a0d0eb

  • memory/1488-5-0x0000000000290000-0x000000000029F000-memory.dmp

    Filesize

    60KB

  • memory/1488-6-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1488-7-0x0000000000290000-0x000000000029F000-memory.dmp

    Filesize

    60KB

  • memory/1488-11-0x0000000000290000-0x000000000029F000-memory.dmp

    Filesize

    60KB

  • memory/1488-25-0x0000000000290000-0x000000000029F000-memory.dmp

    Filesize

    60KB

  • memory/1488-31-0x0000000000290000-0x000000000029F000-memory.dmp

    Filesize

    60KB