Analysis
- max time kernel
93s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 00:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe
Resource
win7-20240704-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
4 signatures
150 seconds
General
- Target 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe
- Size 3.0MB
- Sample240719-bajdmaverr
- SHA256 5a6eff305bc9e0a7e470a48f364705ff57d6da47d134418480619c94ecb81d76
- MD5 59cfdee8dbfb6c545a7a306e4ae763ee
- SHA1 b630b6f117d09fce856ef4ef84911a1894c981a7
- SHA512 909f1727a827eb25d4547dd8757d20da3c2d97b8c3c6f8ce5731d8940795fd0e42f18ad6309ac3491d23987ac4b5adb2ed2d83708609b188310b45d2875f8de2
- SSDEEP 49152:ZUcQPNMLiiV7wiEruyJHSg4tV7eUFnpD5mQcY/3kJ:ycQFM20EBnJy1VaUFpt7JkJ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4488 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SkinH_EL.dll 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SkinH_EL.dll 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\SkinH_EL.dll 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4488 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe 4488 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe 4488 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe 4488 59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59cfdee8dbfb6c545a7a306e4ae763ee_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4488
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\SkinH_EL.dll
- Size 688KB
- SHA256 573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48
- MD5 bd42ef63fc0f79fdaaeca95d62a96bbb
- SHA1 97ca8ccb0e6f7ffeb05dc441b2427feb0b634033
- SHA512 431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c
- SSDEEP 12288:AuOtG9rMIfLpoTp2/WFH8bW7INLtK4dRjKCHd:9z9OIu4d1KCHd
- MD5 SHA1 SHA512 SSDEEP