Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
20-05-2024 09:30
General
-
Target
5e5cb9a1be725bbcfef55f98502d874d_JaffaCakes118.exe
-
Size
352KB
-
MD5
5e5cb9a1be725bbcfef55f98502d874d
-
SHA1
543febff0e53c7f5badb97bd0ab9509530eca434
-
SHA256
f218439bafeb99c3225c252bb9e290a583d674de0890674f7e950376b41fa71e
-
SHA512
0f5f8b0f27f2833a082d01d705427b7eabe57aa85f720494c37f3284ffe5289f45deb7dc1c26f1c504a721233044af211653fae062e529c773347ac141457283
-
SSDEEP
6144:um2w+hJKnBOPPeWKYHI/D08bZujC0DF6D2+hB:HaJiOJK5/SjCa6D2+f
Score
10/10
Malware Config
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e5cb9a1be725bbcfef55f98502d874d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e5cb9a1be725bbcfef55f98502d874d_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2204-0-0x000000007427E000-0x000000007427F000-memory.dmpFilesize
4KB
-
memory/2204-1-0x00000000000D0000-0x000000000012E000-memory.dmpFilesize
376KB
-
memory/2204-2-0x0000000074270000-0x000000007495E000-memory.dmpFilesize
6.9MB
-
memory/2204-3-0x000000007427E000-0x000000007427F000-memory.dmpFilesize
4KB
-
memory/2204-4-0x0000000074270000-0x000000007495E000-memory.dmpFilesize
6.9MB