Overview
overview
10Static
static
1037278f8113...18.rar
windows7-x64
137278f8113...18.rar
windows10-2004-x64
1DuoWei.dll
windows7-x64
10DuoWei.dll
windows10-2004-x64
5Providence.exe
windows7-x64
10Providence.exe
windows10-2004-x64
10idix.dll
windows7-x64
3idix.dll
windows10-2004-x64
3请先下�....0.url
windows7-x64
1请先下�....0.url
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2024 22:37
Behavioral task
behavioral1
Sample
37278f8113745774640f5b647de0bf7a_JaffaCakes118.rar
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
37278f8113745774640f5b647de0bf7a_JaffaCakes118.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
DuoWei.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
DuoWei.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Providence.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Providence.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
idix.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
idix.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
请先下载安装.NETFramework4.0.url
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
请先下载安装.NETFramework4.0.url
Resource
win10v2004-20241007-en
General
-
Target
37278f8113745774640f5b647de0bf7a_JaffaCakes118.rar
-
Size
130KB
-
MD5
37278f8113745774640f5b647de0bf7a
-
SHA1
ec633bb28de73082fc3c08cdca464da47e874471
-
SHA256
e5bb20f9f11465cc01d24f5a9c27d4643af924e8b2a03b0d5e109aa15968944b
-
SHA512
52b2c6f6f2dbfa03c94ff9bb5a2c6ee27341e2f4832540feeff27a0248bae2b5b8cd34dece30c34cc30b53bab9f6d9d44d50081087a10f9f856622781e710ba9
-
SSDEEP
3072:5upCvIDP3BuE84SO5fmDzpHknxq8swJC8PXtCmJrFUU:oMSGFcoHUxq8jJC8YmUU
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3320 7zFM.exe Token: 35 3320 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3320 7zFM.exe