Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 13:29

General

  • Target

    06c57f38901ce8b38512b4b1510f8e80_JaffaCakes118.exe

  • Size

    9KB

  • MD5

    06c57f38901ce8b38512b4b1510f8e80

  • SHA1

    237e0b7df26fe773180d7c884b9f60ea672fc0b2

  • SHA256

    b79f954c0674a166060f756b3ef5da25688f2030a9523420ae2cb5a813057545

  • SHA512

    d1f829b0c8df905a8b33656ac2ef221f1a56a7c27550d471edf43135e995503797a2ddd086a78865d6fda98b25dcea31749061fcb533ca0d1e86b1045410237f

  • SSDEEP

    192:bBksuXrN3y+SfeMZZ3S93VnjdwCzM3ymXq:MZofeMuFnhwCQvX

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06c57f38901ce8b38512b4b1510f8e80_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\06c57f38901ce8b38512b4b1510f8e80_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2680-0-0x0000000000280000-0x0000000000288000-memory.dmp

    Filesize

    32KB

  • memory/2680-1-0x00007FFDAD880000-0x00007FFDAE341000-memory.dmp

    Filesize

    10.8MB

  • memory/2680-2-0x0000000000B50000-0x0000000000B62000-memory.dmp

    Filesize

    72KB

  • memory/2680-3-0x0000000002380000-0x00000000023BC000-memory.dmp

    Filesize

    240KB

  • memory/2680-4-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

    Filesize

    64KB

  • memory/2680-5-0x00007FFDAD880000-0x00007FFDAE341000-memory.dmp

    Filesize

    10.8MB

  • memory/2680-6-0x00007FFDAD880000-0x00007FFDAE341000-memory.dmp

    Filesize

    10.8MB