Analysis
- max time kernel
141s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 01:09
General
- Target a34e2b47498b5580575d7c0a9e4245df_JaffaCakes118.exe
- Size 227KB
- Sample240613-bh97bascnl
- SHA256 d6fe00058421684329c1578b7e31658806f25e54372f01cbf88ecc42e7be7417
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34e2b47498b5580575d7c0a9e4245df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a34e2b47498b5580575d7c0a9e4245df_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
dfs4120.tmp
memory/2168-11-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/2168-14-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/2168-2-0x0000000000930000-0x0000000000933000-memory.dmp
memory/2168-7-0x0000000004CF0000-0x0000000004D4C000-memory.dmp
memory/2168-8-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/2168-9-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/2168-10-0x0000000005210000-0x00000000052A2000-memory.dmp
memory/2168-0-0x0000000000CF0000-0x0000000000D7B000-memory.dmp
memory/2168-3-0x0000000074E8E000-0x0000000074E8F000-memory.dmp
memory/2168-12-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/2168-13-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/2168-15-0x0000000008620000-0x0000000008686000-memory.dmp
memory/2168-16-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/2168-25-0x000000000A990000-0x000000000B136000-memory.dmp
memory/2168-26-0x0000000000CF0000-0x0000000000D7B000-memory.dmp
memory/2168-27-0x0000000000930000-0x0000000000933000-memory.dmp
memory/2168-28-0x0000000074E8E000-0x0000000074E8F000-memory.dmp
memory/2168-29-0x0000000074E80000-0x0000000075630000-memory.dmp