Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13-07-2024 22:10
General
-
Target
4388b345b99f6ad0c235509aa455fcf2_JaffaCakes118.exe
-
Size
126KB
-
MD5
4388b345b99f6ad0c235509aa455fcf2
-
SHA1
ff5d94e4ee79c8d650d04aa2fe2f6024ea346e86
-
SHA256
805c7b1003bdacfb853c4390157116614d1a02a042acfb9f8076339a64f42e91
-
SHA512
a02b003b02ed14aacf01ad20d94703a5cd5ba709a254e0e6cd2ee27cf5ef4a28c0df69f9e3bc0a2a1104886e72edd924a3069a9a8df2d38acb54185bf2814abc
-
SSDEEP
3072:/KgyyAQXskowMqgHi1IUqFL2un0/2MkEjFliDI8+o:SlyAQX/ob5Cvo2ulUjFQI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4388b345b99f6ad0c235509aa455fcf2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4388b345b99f6ad0c235509aa455fcf2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\services.exeC:\Users\Admin\AppData\Local\Temp\services.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5a23ecff9ef42624857ab6061d38ea269
SHA1f9550e8ff9dcbdc4fc2f917d6163853bc7e33c77
SHA256b3acc4395055ff4d6359930ce2fefe7b4426ea1cae654394ad4ad0c447c244b2
SHA512045f28df56fe764750db0cf4ddae80db726af6a5b4ef43c8f6d5ac83271b0c536a7f03c9e00256e65cbc76b41e0dd2cc5a0a06faefd6876a187f64fc0320fb66
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
156KB