Analysis
- max time kernel
140s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 01:25
General
- Target 90199f461b7e4d937d9e80662693ab09_JaffaCakes118.exe
- Size 227KB
- Sample240603-bs68eaec3x
- SHA256 5dd7b3eb3f743330c234108d2faa53a2d6b60fe7d8a348d30ffd3ba97b3542fa
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90199f461b7e4d937d9e80662693ab09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90199f461b7e4d937d9e80662693ab09_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
dfs519A.tmp
memory/1012-11-0x0000000005440000-0x00000000054D2000-memory.dmp
memory/1012-13-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1012-1-0x00000000007A0000-0x00000000007A3000-memory.dmp
memory/1012-7-0x0000000004EF0000-0x0000000004F4C000-memory.dmp
memory/1012-8-0x0000000004F50000-0x0000000004F5A000-memory.dmp
memory/1012-9-0x0000000005910000-0x0000000005EB4000-memory.dmp
memory/1012-10-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1012-0-0x00000000007B0000-0x000000000083B000-memory.dmp
memory/1012-3-0x00000000747AE000-0x00000000747AF000-memory.dmp
memory/1012-14-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1012-12-0x0000000005600000-0x000000000560A000-memory.dmp
memory/1012-15-0x0000000007130000-0x0000000007196000-memory.dmp
memory/1012-16-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/1012-25-0x000000000AA40000-0x000000000B1E6000-memory.dmp
memory/1012-26-0x00000000007B0000-0x000000000083B000-memory.dmp
memory/1012-27-0x00000000747AE000-0x00000000747AF000-memory.dmp
memory/1012-28-0x00000000747A0000-0x0000000074F50000-memory.dmp