Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24/06/2024, 10:28
General
-
Target
07f7a25e73336981be470e77cbad2b6d_JaffaCakes118.exe
-
Size
245KB
-
MD5
07f7a25e73336981be470e77cbad2b6d
-
SHA1
e70a5e684a164895f0d6346caa18f9591318324e
-
SHA256
90644b26edb6f82b8af979d27ed9f82eeac2027e2f283e7cbf7e3b49a2edd313
-
SHA512
2bb995adddab1a927f8eeb67b1e876c2bad49e556dbd4a6e544f00f3f170c0de911f284675f53243b017dc292c4e4441a4bd012dcac1728e57aeed9885626044
-
SSDEEP
6144:hBCb2cOL7SLMOQi9gvjVNQQjIwfQqsDbxRA0U:hBChWIOvjV61LA0U
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07f7a25e73336981be470e77cbad2b6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07f7a25e73336981be470e77cbad2b6d_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
488KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB