Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 06:28
Behavioral task
behavioral1
Sample
f0794d5310c299d4ac102beda80eaea9_JaffaCakes118.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0794d5310c299d4ac102beda80eaea9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
f0794d5310c299d4ac102beda80eaea9_JaffaCakes118.exe
-
Size
24KB
-
MD5
f0794d5310c299d4ac102beda80eaea9
-
SHA1
b308cb9f762bc27ce502ae5c9ed7deab7885f028
-
SHA256
3bf2c814ade54ce77c12ad089043709d78281e6b0433fbbd8010663e01a976b8
-
SHA512
1c5b323f445c258a1db87621e68c479b526f72097f3025b2698a06d6c6da1f4fc5ab5967d2a09d5de5b616c174456f886f83404251f11af9c371700d742390e4
-
SSDEEP
192:QNrAjPzOpqUg7oGtl7E3cCVLGxjMPeuxVGpwHVboitxI0:QNrAnAELb7r+u1Iu6FoizI0
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 57 IoCs
Processes:
flow ioc 30 pastebin.com 39 pastebin.com 55 pastebin.com 64 pastebin.com 97 pastebin.com 92 pastebin.com 31 pastebin.com 42 pastebin.com 43 pastebin.com 65 pastebin.com 81 pastebin.com 91 pastebin.com 67 pastebin.com 107 pastebin.com 94 pastebin.com 96 pastebin.com 36 pastebin.com 109 pastebin.com 110 pastebin.com 37 pastebin.com 41 pastebin.com 63 pastebin.com 74 pastebin.com 46 pastebin.com 68 pastebin.com 85 pastebin.com 93 pastebin.com 99 pastebin.com 66 pastebin.com 73 pastebin.com 79 pastebin.com 101 pastebin.com 35 pastebin.com 59 pastebin.com 75 pastebin.com 90 pastebin.com 100 pastebin.com 103 pastebin.com 76 pastebin.com 77 pastebin.com 80 pastebin.com 98 pastebin.com 105 pastebin.com 62 pastebin.com 95 pastebin.com 40 pastebin.com 78 pastebin.com 88 pastebin.com 104 pastebin.com 106 pastebin.com 61 pastebin.com 38 pastebin.com 60 pastebin.com 72 pastebin.com 82 pastebin.com 102 pastebin.com 108 pastebin.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f0794d5310c299d4ac102beda80eaea9_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1912 f0794d5310c299d4ac102beda80eaea9_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1912-1-0x00007FF9CCB60000-0x00007FF9CD501000-memory.dmpFilesize
9.6MB
-
memory/1912-0-0x000000001C390000-0x000000001C85E000-memory.dmpFilesize
4.8MB
-
memory/1912-2-0x00000000017F0000-0x0000000001800000-memory.dmpFilesize
64KB
-
memory/1912-3-0x000000001BD70000-0x000000001BE16000-memory.dmpFilesize
664KB
-
memory/1912-4-0x000000001C860000-0x000000001C8C2000-memory.dmpFilesize
392KB
-
memory/1912-5-0x00007FF9CCB60000-0x00007FF9CD501000-memory.dmpFilesize
9.6MB
-
memory/1912-6-0x00007FF9CCB60000-0x00007FF9CD501000-memory.dmpFilesize
9.6MB
-
memory/1912-7-0x00007FF9CCB60000-0x00007FF9CD501000-memory.dmpFilesize
9.6MB