Analysis
-
max time kernel
68s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 06:11
Static task
static1
Behavioral task
behavioral1
Sample
06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe
-
Size
458KB
-
MD5
06fda40ce41ed4e20afd6693b3271f0c
-
SHA1
36041a992aa779fc5e5f0ef705ea41ee804bd533
-
SHA256
f1e4d688cde929f22bd3bab236f3e8bdff117cd80ec04776afa3a93be35c96b6
-
SHA512
ef0c3b6ca80c30f8f18516715262758dc514544bc8185d2bbe4044901a5c5de65ef89eb7ca8aafa6706b4f6ee05eb5870e486952d21d0e18fc34e3ff4bd84850
-
SSDEEP
6144:LHFn/5EIFfwnb4ylKxh5Vn5TKLjgp8cAe4WDc46wCWFGmxllgMeN+anWl9+YX:vFfGb41xtn5ufgpLA46w5NlS3Wl9V
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4428 adgwsukbgauoppf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4428 adgwsukbgauoppf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4428 adgwsukbgauoppf.exe 4428 adgwsukbgauoppf.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5096 wrote to memory of 4428 5096 06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe 86 PID 5096 wrote to memory of 4428 5096 06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06fda40ce41ed4e20afd6693b3271f0c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\adgwsukbgauoppf.exe"C:\Users\Admin\AppData\Local\Temp\\adgwsukbgauoppf.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4428
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5aac5ed13dc19a296da596b37f09809b9
SHA19f93e6281386df5ae0525d9d3036cb4a74df4ac4
SHA2566522244da8cb88bbf07ef2c7bdd81a62daf6e24df39d3c331a31b00d8954790e
SHA51211e9b499670c97f0e2ab4a0d6ff6952e697d67d43c91ec84be7c817c74dc450ac98ad20cdcfbf2028de97aa69ce13de56a15481b6402b9c9d9dc158a8256ece4
-
Filesize
458KB
MD506fda40ce41ed4e20afd6693b3271f0c
SHA136041a992aa779fc5e5f0ef705ea41ee804bd533
SHA256f1e4d688cde929f22bd3bab236f3e8bdff117cd80ec04776afa3a93be35c96b6
SHA512ef0c3b6ca80c30f8f18516715262758dc514544bc8185d2bbe4044901a5c5de65ef89eb7ca8aafa6706b4f6ee05eb5870e486952d21d0e18fc34e3ff4bd84850