Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10/05/2024, 03:56
General
-
Target
2d3782f2f01538588c13de083e2d73d8_JaffaCakes118.exe
-
Size
433KB
-
MD5
2d3782f2f01538588c13de083e2d73d8
-
SHA1
3cf40de3902404ff8dbe58634266dff130e43d3b
-
SHA256
fb9228bc91fe6e28a14d8df485ba7e1e12dfd30a111e828fe465cf672f0eb40b
-
SHA512
5befb1d4f4fd17b50d26b3de18b7220593ea33c1cb024da2af1cc703f414c69d7365fd73c3d54f94f0aa1ab0f1daab07d5fc27029c521e6f2cecf30148144e96
-
SSDEEP
6144:4LV6Bta6dtJmakIM54I59M+KwOPv0ebfvEqtN1sz+5N7y59w5W:4LV6Btpmk3P3bHEqv1H29wQ
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d3782f2f01538588c13de083e2d73d8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d3782f2f01538588c13de083e2d73d8_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB