Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 07:46

General

  • Target

    df3a05f419ab5ae3cb39f78aab24f821_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    df3a05f419ab5ae3cb39f78aab24f821

  • SHA1

    0603fd64820d1d559bb35919a2980d0a4e632bef

  • SHA256

    755d581cbfcd526acdd1855fe76e542a27ea8081b3830fa7488fd72f74962d28

  • SHA512

    e7e1319b34781bbeed7351c1dfdb8d1d99219d6d2a597ed5a7eeee7f8c9a99da255071869906844071eb91ea343e9ef44e0fc56cd0c400c886f84be45cc53ad9

  • SSDEEP

    3072:w2MfmQK1IVi4j6WM/Zfgv6J6INEybZo+PUmm+mf3hW2pUt1GcsEC8:rMfm6U4j63ea6Zyb7UL+mriT/

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df3a05f419ab5ae3cb39f78aab24f821_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\df3a05f419ab5ae3cb39f78aab24f821_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1688

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1688-0-0x00000000012F0000-0x0000000001318000-memory.dmp

          Filesize

          160KB

        • memory/1688-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

          Filesize

          9.9MB

        • memory/1688-2-0x000000001B310000-0x000000001B390000-memory.dmp

          Filesize

          512KB

        • memory/1688-3-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

          Filesize

          9.9MB