Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe
-
Size
101KB
-
MD5
3a04260dfa636f9172dc5eb84dac7e7d
-
SHA1
90ade6bf5c689b88382e3b77c556fa6e3cd4ef98
-
SHA256
ae2ca28319718973b396dafe5fee585cd0524fcb7fe7131a8a645bc9ed6dc2dd
-
SHA512
2967e821015d93d1df96bb32dfe9497b7709ccbc53f88b84edb89d1f448951c33fdf5b6900f9ed1241576bd0f131f8719ce4f265e850d00d01d2406463448be6
-
SSDEEP
3072:hFc9tCOn/AXHoLfFfOs16ocR5v0g0EzJtp2zEefLCE1mm:hFcaRXO0vFJtp2zEefGU
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2568 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\C19D04AC.dat 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\C19D04AC.dat 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\C19D04AC.dll 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\C19D04AC.dll 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Help\C19D04AC.chm 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe File opened for modification C:\Windows\Help\C19D04AC.chm 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2568 3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a04260dfa636f9172dc5eb84dac7e7d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2568
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD53a04260dfa636f9172dc5eb84dac7e7d
SHA190ade6bf5c689b88382e3b77c556fa6e3cd4ef98
SHA256ae2ca28319718973b396dafe5fee585cd0524fcb7fe7131a8a645bc9ed6dc2dd
SHA5122967e821015d93d1df96bb32dfe9497b7709ccbc53f88b84edb89d1f448951c33fdf5b6900f9ed1241576bd0f131f8719ce4f265e850d00d01d2406463448be6
-
Filesize
50KB
MD527ced2bf837ff615414b2ba1ec94a34f
SHA147b6d51a9d8f2d564f2771d994d43a218e37b452
SHA256126ae3803bd4acf60db61481b5ae474d6feed53b669051952ea584e5f22bdb05
SHA5127657f663a375484f2258d0af6342e094cd8af03dbeb98633d5d355fb6037e6ef4a545ea6615528210aa966b010c0f35248a17a9ff89d342140b12deba18ec317