Overview

overview

10

Static

static

1

71fb9e938a...18.exe

windows7-x64

1

71fb9e938a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 12:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71fb9e938a34ba1fae84d05f29cd577b_JaffaCakes118.exe

  • Size

    251KB

  • MD5

    71fb9e938a34ba1fae84d05f29cd577b

  • SHA1

    4a68253ed05fcf9a6476307cf06952694e6a91ac

  • SHA256

    5a8c4049c0e4005dc517d1237e9e0263b6db3f247149e260f4e6004050c5254f

  • SHA512

    12496a63938da925f2376bc8d5f105f66e2d38ca59bc5a49f7a771b8e0b05c11d846b3abcfdb318ddb62747ca346285bc665f1618aaa1c9804a29ac6a7accf3e

  • SSDEEP

    3072:c3uquE7K6wTKwinObMIZQCqW9vYjaXvI3f0/LZdUYKRxca61h8Hl4D1NmyHuyse2:cel1T7kObMKQCiaoEj5j8HMITeBLZm

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader 4 IoCs

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Tries to connect to .bazar domain 3 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71fb9e938a34ba1fae84d05f29cd577b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\71fb9e938a34ba1fae84d05f29cd577b_JaffaCakes118.exe"
    1⤵
    • Bazar Loader
    • Suspicious behavior: EnumeratesProcesses
    PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1472-0-0x00000285D08E0000-0x00000285D0908000-memory.dmp
    Filesize

    160KB

    Download
  • memory/1472-4-0x0000000180000000-0x000000018002A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/1472-9-0x00000285D08B0000-0x00000285D08D6000-memory.dmp
    Filesize

    152KB

    Download
  • memory/1472-11-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1472-10-0x00007FFEA7B2D000-0x00007FFEA7B2E000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1472-12-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1472-20-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp
    Filesize

    2.0MB

    Download