8e926a38ebcae40a9153ac8592df559ff246ba77e5f92c273fe983a5f266d647 | Triage

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 12:19

Sharing

Report Analysis Logs

General

Target

45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
Size

207KB
MD5

45c8d14a29de67699c202ce3aa798aac
SHA1

07500ade69a3308f21b48a9ffaf5c43c5a44aabf
SHA256

8e926a38ebcae40a9153ac8592df559ff246ba77e5f92c273fe983a5f266d647
SHA512

5fa856310f080d3b8147296ac8be50d4b6ed0dad5f991f61925cc845b43a0eeca0b19f8c262853ece4a5b808371ddba9d6c29da109362094151f7e09ac7c9b32
SSDEEP

6144:jqZTw1YAIQ/iKewGwyuJjAM5IIGr2bwr:Dqp295X

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mshdtxt32.dat	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cftmon.exe	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshdtxt32.dat	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4000	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
4000	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
4000	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
4000	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4000	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
4000	45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45c8d14a29de67699c202ce3aa798aac_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4000-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4000-5-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download