Overview

overview

10

Static

static

3

60de65a6d3...18.exe

windows7-x64

3

60de65a6d3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 18:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60de65a6d39470feecd3d25e4d952307_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    60de65a6d39470feecd3d25e4d952307

  • SHA1

    4bd650134d6ca96346b3421f4dd86e9fc4c0a2d3

  • SHA256

    e880938da7fc6c80f607a6eda33bf60edf9c7a089d3b40d8f891ad530c701e42

  • SHA512

    13827f4da2acbae07be36496fe58910de6d533b2453c6ca859b1b4ce312da5317df76ae9b09d2cb2f640e7384fd38b893109f7a0f699166edd664067dfa8e8a6

  • SSDEEP

    24576:GjOBDmNtPrRduD+FTUF90qFwRBhvbhhiGerG7hR/0O04AfnJvEn:GjO5mNtduX90TljhheWFAfnJc

Score
10/10
evasion

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 4 IoCs
    evasion
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60de65a6d39470feecd3d25e4d952307_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\60de65a6d39470feecd3d25e4d952307_JaffaCakes118.exe"
    1⤵
    • Modifies firewall policy service
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1176-0-0x0000000000400000-0x0000000000564000-memory.dmp

    Filesize

    1.4MB

    Download