Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13-05-2024 08:51
General
-
Target
3ea8b794de6c6e1bd0a1ecccb8ab66cb_JaffaCakes118.exe
-
Size
202KB
-
MD5
3ea8b794de6c6e1bd0a1ecccb8ab66cb
-
SHA1
264c61b835725e6bbddfeeaa481bd9d7ba60a883
-
SHA256
c3e2acc7775ec422784812026f00c838ed7995e7b2a4a04dbdd14c6e2b62c5a8
-
SHA512
bf0b5fa89e8c0af97d564d65f263c9bc6ea13a6a9c1290f79b17e7b38c9d26672656038c938a6fb87f0175d0cfc9535f0efb6e80d840e380cf341ffd40e5b4f4
-
SSDEEP
3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIXMsb4F5e9nOjbdIlmvujtJrAr:QLV6Bta6dtJmakIM5VSOvh2RCh2Q
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ea8b794de6c6e1bd0a1ecccb8ab66cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ea8b794de6c6e1bd0a1ecccb8ab66cb_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2400-0-0x00000000742C1000-0x00000000742C2000-memory.dmpFilesize
4KB
-
memory/2400-1-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/2400-2-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/2400-4-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB