Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
5cc28f3f32e7274f13378a724a5ec33a_JaffaCakes118.ps1
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5cc28f3f32e7274f13378a724a5ec33a_JaffaCakes118.ps1
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
5cc28f3f32e7274f13378a724a5ec33a_JaffaCakes118.ps1
-
Size
389KB
-
MD5
5cc28f3f32e7274f13378a724a5ec33a
-
SHA1
32292b4e125287a6567e3879d53d0d8d82bcdf01
-
SHA256
18f0ad8c58558d6eb8129f32cbc2905d0b63822185506b7c3bca49d423d837c7
-
SHA512
319c311e01679d8d3d5e4fb140ac993cf00ad8dcd5275dedd43afc652b6f9bac26e56d47fb4f83acfd6447b2f117c24d9d6b7b886d7de9f7438ff3156fbb3ec5
-
SSDEEP
6144:l2VarLYIHEa7b0Zwsc4/eBaiOANQAgRuKJpUvCaUW:Eat6ZJpUaW
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2456 powershell.exe -
pid Process 2456 powershell.exe 2764 powershell.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2456 powershell.exe 2456 powershell.exe 2456 powershell.exe 2456 powershell.exe 2764 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 2764 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2764 2456 powershell.exe 29 PID 2456 wrote to memory of 2764 2456 powershell.exe 29 PID 2456 wrote to memory of 2764 2456 powershell.exe 29 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21 PID 2764 wrote to memory of 1204 2764 powershell.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1204 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\5cc28f3f32e7274f13378a724a5ec33a_JaffaCakes118.ps12⤵
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file C:\windows\temp\tmp2673.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d35ff22a7af93347587719a6135d22c5
SHA1f4b83e67feccc4f9b1518974e7887e529cbb1175
SHA2564fa74dd232a236e3f447524cf0f7a1ee611bf8433adba55b9583eba5a1f684e5
SHA5129e81d2b8049f84a83d143e43337b8e8b897a8f1c75c87a25b6dee4558260db2dade455f91da3ded268b0c9e4b684b36ad9466fb68bfb2fcb4bfb9669d7da27eb
-
Filesize
388KB
MD55770776ca526663bd1ca30f0a46f0cc3
SHA151a441668fcfdffa689b2314362ebd959be77e95
SHA256faeebf486c8a2667d9917a4fe8983aa42479ae0a71efd777f6d37bc960796411
SHA51266d85edc284d4d2d56544ba98bad51331cd687d3e47b095d918ccfd33d1ad5b7bb2ed2adaba24cacebccad36baeaa884381906034929c245ea62c9ed2e21888a