Overview

overview

6

Static

static

3

f9fff62316...18.exe

windows7-x64

6

f9fff62316...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 09:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe

  • Size

    216KB

  • MD5

    f9fff623168e9e240a5c224cc41443a9

  • SHA1

    9d67bb3638a21162495886b51d9d38df14957348

  • SHA256

    6d222c1a1efb59bb4a5522979f7f648c783c7ce03a6be5031c1d8125a8dd2c62

  • SHA512

    df701c8641f501df96db51b46d437bd18d0143024e3de3382541f3297f328e9350b265c166627aa8fb464bc8753457fcaf7f04cb0e740075f122cb04eff8271c

  • SSDEEP

    3072:FZE2FrVViMrhmRk+EyVjYYrBde25VwB5t+:F3VZ9Oj5Bd9K5

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3812-0-0x0000000000310000-0x000000000034E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/3812-1-0x0000000074550000-0x0000000074D00000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-2-0x0000000004B60000-0x0000000004BFC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/3812-3-0x0000000005210000-0x00000000057B4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3812-4-0x0000000004D00000-0x0000000004D92000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3812-5-0x0000000004C40000-0x0000000004C50000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3812-6-0x0000000004C60000-0x0000000004C6A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3812-7-0x0000000004EF0000-0x0000000004F46000-memory.dmp

    Filesize

    344KB

    Download

  • memory/3812-9-0x0000000074550000-0x0000000074D00000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-10-0x0000000004C40000-0x0000000004C50000-memory.dmp

    Filesize

    64KB

    Download