Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 04:22

General

  • Target

    f50641a335b856c0a7b7d0c7e0f56b45_JaffaCakes118.ps1

  • Size

    84KB

  • MD5

    f50641a335b856c0a7b7d0c7e0f56b45

  • SHA1

    4972cc2ced7817a0a3556997a3718025b35a407f

  • SHA256

    f927621a7bd2548f85a44695c585163e5d258ba8d2c81eb1d3b00b237443e3cf

  • SHA512

    e73be5e4bf65859d71f3d850c6aa11e7e8ba3f929283a78cfadc6cedde722b3e7b53b5090ed7ecfa4081bffa3ab3b4128c9d846973cda3d015e8f34c13f25d2f

  • SSDEEP

    1536:TcSoPFh67RiCEPzo/rJV4Jx59PwpMvj7QInrLdJg9mRY1tW:kPE9WJ1PRnrJJgUGW

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f50641a335b856c0a7b7d0c7e0f56b45_JaffaCakes118.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1620-4-0x000000001B500000-0x000000001B7E2000-memory.dmp

    Filesize

    2.9MB

  • memory/1620-6-0x0000000002690000-0x0000000002698000-memory.dmp

    Filesize

    32KB

  • memory/1620-5-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB

  • memory/1620-7-0x0000000002CF0000-0x0000000002D70000-memory.dmp

    Filesize

    512KB

  • memory/1620-9-0x0000000002CF0000-0x0000000002D70000-memory.dmp

    Filesize

    512KB

  • memory/1620-8-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB

  • memory/1620-10-0x0000000002CF0000-0x0000000002D70000-memory.dmp

    Filesize

    512KB

  • memory/1620-11-0x0000000002CF0000-0x0000000002D70000-memory.dmp

    Filesize

    512KB

  • memory/1620-12-0x0000000002CF0000-0x0000000002D70000-memory.dmp

    Filesize

    512KB

  • memory/1620-13-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB