Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/04/2024, 11:56
General
-
Target
e27d70c83690a92a9e6759763fa814e7_JaffaCakes118.exe
-
Size
16KB
-
MD5
e27d70c83690a92a9e6759763fa814e7
-
SHA1
27eeb9b00c0e49ef489f1535c8442f288def2e0b
-
SHA256
72207f291b9e88a8ab5910773ac8c11b53f0646cf840f89e220a7bf1d2f1ee86
-
SHA512
f094a938712e1640b6c4ea15d917672a4dd50105044ae955b424447b509facbd3b7368412ccd1d15834258764078376269530daa0a9a447fcc00b62207205aa6
-
SSDEEP
384:X4YLk+COgc5XW8liKNpY0BXjbtw3Ge6RiIuYeVjal/4:X4DW5XW8YAptwabRog
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e27d70c83690a92a9e6759763fa814e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e27d70c83690a92a9e6759763fa814e7_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\spoolsrv32.exe"C:\Windows\System32\spoolsrv32.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5bb3ed63a961761be10ed02747ceaa987
SHA1895a93d05702b87c4f34652e35d1afd940169312
SHA256a1773a0b4595ea44a5c4b0de76b140263796904a8e1c609f58308bc35d1e3ee0
SHA51261cd4c184e6ee3dc2cf3119764e4e57c5c27b0887835b8234dc244808ed9da19cb546fff488c3493655aa178977b6a9ba1bd99f08e99a397ea21049d635f53d4
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
44KB