Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/04/2024, 21:31
General
-
Target
f69da6d48b7166b4cb401559d4e419ac_JaffaCakes118.exe
-
Size
15KB
-
MD5
f69da6d48b7166b4cb401559d4e419ac
-
SHA1
9664f630bf4325748c35d9889ca094746492ecdf
-
SHA256
020fd9788958d38c9e8e48064a8dbc179fabb5d2da2d7ca6f5b8dde65e14da07
-
SHA512
7bc8ab6b82f4fc09562f8c890440a2423a4613687ac2aef82edc93d0f0a8430dd61565f790f258424567463b3666aa7ec19dd82cb778ce2c1b902bd8e99b9416
-
SSDEEP
384:VPSO3F+WW6Mk+PCjlN3enNzxIHjis1+106CJc1G8UTv/l:VPl+IMNElheVORczLGNvt
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\f69da6d48b7166b4cb401559d4e419ac_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f69da6d48b7166b4cb401559d4e419ac_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD593423a9136d33768c0663ce29353a5b9
SHA1bcec72bb1947e7540c7b8f1c4ca0696fa055968c
SHA2568eb72eaf0c921a86801a952838c2494ca57a446cbfbeda509c1a55d6122c4151
SHA51254c90ccc80641e18d5e416f5fce220d36868e6d101245d1f3203e533a2553c9c755b0d8bd1b5d1eb95051d77dbf180b2281cae536a3549d10b86540d0149d192
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB