Analysis
-
max time kernel
2s -
max time network
2s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
24/06/2024, 07:07
Errors
Reason
Machine shutdown
General
-
Target
071a067c1e3c2ea2987008135c3432b1_JaffaCakes118.exe
-
Size
100KB
-
MD5
071a067c1e3c2ea2987008135c3432b1
-
SHA1
aa35e537db0e1b0869e896cdbef29240b673a395
-
SHA256
0f007a2ae28a7ed10f7443f4fc1f68c0ca599a4ca21f8595fd02543e644e4987
-
SHA512
653ae2e158b20e652add47b2007f8cd3ed2a99f1616dc0fd27df34c119cae5fc2ea66a26edb88f53999080e5552026f5a195f5028bd5afefa498a2bfcea3a05a
-
SSDEEP
1536:jwflMfUEcuTWL7QqbZIEtE0ZVAanFnp5IGojDhH1MyDXLHoXSSSeSSS+y:wlFruI7BbntE0ZV7nFp58t17rLHof
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\071a067c1e3c2ea2987008135c3432b1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\071a067c1e3c2ea2987008135c3432b1_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
104KB