Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 16:30
General
-
Target
cdf93f9e5ff7ee1a4118cb3f75c9ea05_JaffaCakes118.dll
-
Size
966KB
-
MD5
cdf93f9e5ff7ee1a4118cb3f75c9ea05
-
SHA1
7faac8f94284a037da2fc5d1606ab0dfe74a2851
-
SHA256
2bd7a2153ce51e2a0e9b1f197c51ee7eab05f5bb46fbaffe53294d18be89969b
-
SHA512
2655514785b459a5189c635a7b77eba505a1cd58fad8334836a03c05aab472554faa9c03491697753381ac439155d682fd021ef107c2f92c4ad7f5a8c7f3176d
-
SSDEEP
12288:9FPqJkfrZmZorIq/iD8dff7cYlAQ9ua0jgMOQc+QkA6zy9Ha:PPqJkDZmerIN4pQYlj9nGqQEkA1Ha
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
161.35.95.83
161.35.144.108
whitestorm9p.bazar
bluecloud21c.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazarloader family
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cdf93f9e5ff7ee1a4118cb3f75c9ea05_JaffaCakes118.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf93f9e5ff7ee1a4118cb3f75c9ea05_JaffaCakes118.dll,StartW {81CD2773-9460-46F7-AA24-5F11F67053B5}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB