Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 23:41
General
-
Target
3766646d032ae30b154c3d91be1c6e1e_JaffaCakes118.dll
-
Size
288KB
-
MD5
3766646d032ae30b154c3d91be1c6e1e
-
SHA1
b85b7f996b9a4400254db8e42ef5f1e578a20896
-
SHA256
4af7dd47164faa6fb7c4e979026fd4badf5330f68c1ee65df0d74532ff060cd7
-
SHA512
244e2c789ae99db462ada5b258fb8e1e83a91cb7a77eb9df0124c4ef72fc98662dbd5ef24a0ee52dc4bec6020547b01676795bf07f35a77a193316ae2892c13f
-
SSDEEP
3072:p6QlU5T0+vk+wYDgN3XwmbvV4Ynnbe9rhNifQMpnIjZ9jAPUn4CbwKL0Fo3dgqT1:pXEwZSZeKZVA6BNL0F1h31eMgIfY
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
128.199.54.51
161.35.152.204
161.35.95.166
whitestorm9p.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3766646d032ae30b154c3d91be1c6e1e_JaffaCakes118.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3766646d032ae30b154c3d91be1c6e1e_JaffaCakes118.dll,StartW {21F59B02-2F48-4826-B42B-78B9608F1717}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB