Analysis
- max time kernel
93s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 01:40
General
- Target a3679c38c53ecd77dbe8656c1a930782_JaffaCakes118.exe
- Size 453KB
- Sample240613-b3yzsazcjd
- SHA256 970625fc5dbf79ad36253fe27025ee5c801618cd7e5a5de9cce370853a59b9f4
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3679c38c53ecd77dbe8656c1a930782_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3679c38c53ecd77dbe8656c1a930782_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\djgmejcgdblwff.exe"C:\Users\Admin\AppData\Local\Temp\\djgmejcgdblwff.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
djgmejcgdblwff.exe
parent.txt
memory/4036-10-0x0000000001330000-0x0000000001338000-memory.dmp
memory/4036-11-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-5-0x000000001BF00000-0x000000001C3CE000-memory.dmp
memory/4036-3-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-7-0x000000001C470000-0x000000001C50C000-memory.dmp
memory/4036-6-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-2-0x00007FF81C135000-0x00007FF81C136000-memory.dmp
memory/4036-4-0x000000001B9F0000-0x000000001BA34000-memory.dmp
memory/4036-12-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-13-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-14-0x000000001FC10000-0x000000001FC72000-memory.dmp
memory/4036-17-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-26-0x0000000021C50000-0x00000000223F6000-memory.dmp
memory/4036-27-0x00007FF81BE80000-0x00007FF81C821000-memory.dmp
memory/4036-28-0x00007FF81C135000-0x00007FF81C136000-memory.dmp