Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 08:44
Behavioral task
behavioral1
Sample
490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe
-
Size
567KB
-
MD5
490d076e85d2e327062f08ea543cfb71
-
SHA1
03d826b183371ce69a1b34c3e19276c110791fa9
-
SHA256
d7d0a3f63a25dceac61f66cf2e484d9817a735606a5f744cf51c1c1097945519
-
SHA512
7917fc021f1026a32be6ab9e8e9cec7c9b19d683a3340210438b8c9f83bc812e98ab1847cf2d833e57ff77bea59ac4e8ebd87e05013b3f0a4c071deae28478e6
-
SSDEEP
12288:w5tFlafPfvsLMDqLMfna6OqDpE+ZMdUki/88i/HTZ2mNJwMKfLElVxA:GlsXvsLMC4a6OqOF+5ibZxVSYlVu
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1596-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1596-5-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe 1596 490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\490d076e85d2e327062f08ea543cfb71_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5638e737b2293cf7b1f14c0b4fb1f3289
SHA1f8e2223348433b992a8c42c4a7a9fb4b5c1158bc
SHA256baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b
SHA5124d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12