Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
19317da5733e40de48774b836f81b6edd83a60976ef180b6e796928399cee1c3.ps1.jaffacakes118.ps1
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
19317da5733e40de48774b836f81b6edd83a60976ef180b6e796928399cee1c3.ps1.jaffacakes118.ps1
Resource
win10v2004-20240226-en
General
-
Target
19317da5733e40de48774b836f81b6edd83a60976ef180b6e796928399cee1c3.ps1.jaffacakes118.ps1
-
Size
9.0MB
-
MD5
c867dbeca2907417d58f0bfb4de699d6
-
SHA1
fa942ea34e59c938d9c307a9c5054118b21fa699
-
SHA256
19317da5733e40de48774b836f81b6edd83a60976ef180b6e796928399cee1c3
-
SHA512
2658decfca16f085932c43ee6397cb449ab7ecf041d2c46630a5fdb3075c21eb9e5836ddb2e9018f4aac99f68ba9a1c3e19973da5c9ca58fc9bb2f7278b557e5
-
SSDEEP
24576:sEAjJLSsZ05S8PllqWR4Q4/YVwCxCpMt8JNim5irz5aRt5vQZUZMc7JS0Ccn3ban:W8RVkwoFZ0qQpynBV
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1656 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\19317da5733e40de48774b836f81b6edd83a60976ef180b6e796928399cee1c3.ps1.jaffacakes118.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-4-0x000000001B740000-0x000000001BA22000-memory.dmpFilesize
2.9MB
-
memory/1656-6-0x00000000028E0000-0x00000000028E8000-memory.dmpFilesize
32KB
-
memory/1656-10-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-9-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-8-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/1656-7-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-5-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/1656-11-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-12-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/1656-13-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-15-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-14-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/1656-16-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB
-
memory/1656-17-0x0000000002CF0000-0x0000000002D70000-memory.dmpFilesize
512KB