Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/06/2024, 17:58
General
-
Target
0870476ee065ed62d5e32462af999193_JaffaCakes118.exe
-
Size
635KB
-
MD5
0870476ee065ed62d5e32462af999193
-
SHA1
6d0b38c81cc2141b54cc9f4fb82828e48a647074
-
SHA256
a7b2c2e2eb6e1b04977934db865934f49d41750aef6d87659e742ea98f7b80fd
-
SHA512
485bb21805faa02e052a72125b9d10f779f90322259bab0e27940d2b25a82b5d08ca97de31c6df7094f145eb44baa8df4f04658882d871fe65dcf340c626fafe
-
SSDEEP
12288:1aJjPpKQMZEy/UjswkEAKt6P3DRYd8pDX+kRkMfXlB5AZQOUEdM:1cpKQMZbbwjKTRYGFugkM/lAO1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0870476ee065ed62d5e32462af999193_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0870476ee065ed62d5e32462af999193_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\www.darkst.comC:\Windows\www.darkst.com2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635KB
MD50870476ee065ed62d5e32462af999193
SHA16d0b38c81cc2141b54cc9f4fb82828e48a647074
SHA256a7b2c2e2eb6e1b04977934db865934f49d41750aef6d87659e742ea98f7b80fd
SHA512485bb21805faa02e052a72125b9d10f779f90322259bab0e27940d2b25a82b5d08ca97de31c6df7094f145eb44baa8df4f04658882d871fe65dcf340c626fafe
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
1.4MB