Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b19118225bdc95563ce2247630797d85_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b19118225bdc95563ce2247630797d85_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b19118225bdc95563ce2247630797d85_JaffaCakes118.exe
-
Size
120KB
-
MD5
b19118225bdc95563ce2247630797d85
-
SHA1
df8291327333a737993dce977043963764370e1f
-
SHA256
5754a4fc520d4081ac4aefa2fcc4e905521bcf520a2339e56dacd0c0cf640aa9
-
SHA512
e2243cf4084efc4678a83f61d83022300ba9afe67c12f3ad5107cee8c095694ffffe3707a8852ad2bac80d0af794f2b4a02c46c344650917d52d64c9f29cbbd5
-
SSDEEP
1536:TvYqZJQkv80n3qFQurSHvCmqR0lgB2lpMtVco81tBA30bAKbYIEOyM:T5JDk0G3rSPCkgwDMtCo8HPbfwOy
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rhg = "C:\\Windows\\inf\\rundll32.exe" b19118225bdc95563ce2247630797d85_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\hhdll.dll b19118225bdc95563ce2247630797d85_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\inf\rundll32.exe b19118225bdc95563ce2247630797d85_JaffaCakes118.exe File opened for modification C:\Windows\inf\rundll32.exe b19118225bdc95563ce2247630797d85_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe 2376 b19118225bdc95563ce2247630797d85_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b19118225bdc95563ce2247630797d85_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b19118225bdc95563ce2247630797d85_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD58f8f49714228e0a4195bea5c06f7578b
SHA145bdd143c61339c6a3f28bbd2fddb96bfd89f461
SHA256661bedbe3bce20a771d9e48cd7a14887a890cd157728d480f1ac467c24f4502c
SHA512583938cac0e550450bf312d3c89783e6ccd3daf87a35177aeb32cc756be46e9722cf9781a73d9d8a328e4aa25058f01e9e48511373e8c053318290e6ed9545d8