Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe
-
Size
136KB
-
MD5
adc2d8f43f13258cf66f08d8f1056874
-
SHA1
230bbf4b5ef23ea2d42409aa023d08ebb0cfe05a
-
SHA256
716e918f9f8603c695534c7721ca179ec0528863b19ae51ab9a873bd6c6556f3
-
SHA512
63b0fde7697a02735ed97c47357a61813218a46e11678d3e8b8beb1b410a139e541b2821917c8a8e84d842b956a7b9d27f2f435558cbf63b22f8f9a3077c6182
-
SSDEEP
3072:W5Jb3dp1yX0YIFpjJKEZ1TfBz935+AdnhAv4r63SZ2Fey:Md3dp1qjIK+4a6C
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\xwdll.dll adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\svhost32.exe adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe File opened for modification C:\Program Files\svhost32.exe adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe 2664 adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\adc2d8f43f13258cf66f08d8f1056874_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD50c28e32bb7d3cdf097d8fd4d476d266c
SHA132fa25f7d3d214982bbe6a769eac90f519772904
SHA2569b81d6cf42948673e550e26814182c80fcc25502d121548476c2eff157f77ed3
SHA512452e93f77ae799b4cf4e392ded57f46947960b93b64c857138b95e06c84e20be5b75728798199236bc6ce05d5d055260fd75b3ce2f0d500f48b9a6acee9f45be