Analysis

  • max time kernel
    133s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 03:55

General

  • Target

    15de4e35072513479628fe20a4af739f_JaffaCakes118.exe

  • Size

    979KB

  • MD5

    15de4e35072513479628fe20a4af739f

  • SHA1

    17f3fa650e5599e069e43dff6e02680347ee37b4

  • SHA256

    5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58

  • SHA512

    6c87f407bf0799f701c843c3f1c1a3d36fa078bdda44ad9deef58a16beba1d1556ab04ec791132999c4be3527a570a2cb18a40b110f8a241845cda833efee0f9

  • SSDEEP

    24576:zpI6QHhwDPk5L6nivp6JMuzdXMIKU7f9WqB9sXt0x+a5eIfW:zpIvhF5LezdBzpWq46cD

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15de4e35072513479628fe20a4af739f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\15de4e35072513479628fe20a4af739f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1848-0-0x0000000074CFE000-0x0000000074CFF000-memory.dmp

    Filesize

    4KB

  • memory/1848-1-0x0000000000810000-0x00000000008FE000-memory.dmp

    Filesize

    952KB

  • memory/1848-2-0x00000000050C0000-0x00000000050E0000-memory.dmp

    Filesize

    128KB

  • memory/1848-3-0x00000000057C0000-0x0000000005D64000-memory.dmp

    Filesize

    5.6MB

  • memory/1848-4-0x00000000052B0000-0x0000000005342000-memory.dmp

    Filesize

    584KB

  • memory/1848-5-0x0000000074CF0000-0x00000000754A0000-memory.dmp

    Filesize

    7.7MB

  • memory/1848-6-0x0000000074CFE000-0x0000000074CFF000-memory.dmp

    Filesize

    4KB

  • memory/1848-7-0x0000000074CF0000-0x00000000754A0000-memory.dmp

    Filesize

    7.7MB