Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe
-
Size
22KB
-
MD5
5d812358801d4432d93b6f011bcb50fa
-
SHA1
0e1c37a6e30742c6e9ab732d8a06b65a430bfe45
-
SHA256
d59216a9de9fbdc8301dc10f2ae52e975852b69ae11c34b3e5ae4ee8c81affa0
-
SHA512
605940292a2bc1d768c7da6055267b23f6647394ac998f402f21e2fdd0f379e465cfd791f6afc30b4ea78dee8b9fde700d408cddfb278027b0dddb2effd89262
-
SSDEEP
384:5tp91uLhedOZ373w+uTmYeCqLOvFc1qBt6zHLrYqfou6T2hhCY15HXfG347:rp91OOg3bYTmYRBQL8q/m2hMO3z
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000120fd-4.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2124 5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x00070000000120fd-4.dat upx behavioral1/memory/2124-6-0x0000000000290000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2124-7-0x0000000000290000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2124-10-0x0000000000290000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2124-17-0x0000000000290000-0x00000000002A3000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\5d812358801d4432d93b6f011bcb50fa_JaffaCakes118lw.dll 5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\5d812358801d4432d93b6f011bcb50fa_JaffaCakes118lw.dll 5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2124 5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2124 5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2124
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD530fd1b3a1af50ccebd52874307794903
SHA13d770b15d3c94bd3b12bfec78c386fcbb0c22515
SHA256e5e7bc1dbb6ccde2fe0f58f3cef9cfcc87bc6415bd5c2a239ef16109f7a1ff00
SHA5122ae8fb7ef6342858bd8e1ca9223a2e6765c63f1ac63b368edeca9d9842b8a2c0413fe921290d09f16da5b33d0b622b834a1bbe00f50943ba529141fa9736a1d2