Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 22:25
Static task
static1
Behavioral task
behavioral1
Sample
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
-
Size
100KB
-
MD5
1dabdd40fc265a39611acf8c31fb19db
-
SHA1
e833264f87c3afe871a2ac3ccd78fc77f5bf2965
-
SHA256
91db926d13bb0137347991e30a1ccd093e535ff375e102bfd44d9aae15650d21
-
SHA512
52f85135818d535c5b1bbae76be31ee29e009126ec3bd57dd684b7f6ef8f8a621c5e43c04f63527c796ec1749fdc16a3dc2775d124c594ab97e1d6404b4fe206
-
SSDEEP
1536:9qWp0jUkHuln1NyXwb/Gr3t65UtfssbkWh7A:9/2jzHi/Gmg0ytfu
Malware Config
Extracted
guloader
http://185.161.211.58/Mekino_nanocore_rIfno101.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2160-2-0x00000000021C0000-0x00000000021CC000-memory.dmp family_guloader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exepid process 2160 1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1288,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2160-2-0x00000000021C0000-0x00000000021CC000-memory.dmpFilesize
48KB