Analysis
-
max time kernel
6s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27-06-2024 18:34
Errors
Reason
Machine shutdown
General
-
Target
1712c95f679f0bbc4ff5716e158c4ac7_JaffaCakes118.exe
-
Size
104KB
-
MD5
1712c95f679f0bbc4ff5716e158c4ac7
-
SHA1
dd82d55aeb04eb28b225d46240591ee20ee84c86
-
SHA256
37b9f790d46a30be6dfb352fef574ccd2170f6d3842afb708a5df16d16d32b77
-
SHA512
388715e151e200c375385dafdc04645ac727e043903eb2b852e8ca7433ea5729700d813c366ecbb136177f11750313966150e2aa581d5cc25afd67afb63b670f
-
SSDEEP
1536:U2L7svO7lUAUxHP7Yv5LthtBMcig5H87bbVSceu+nBgyoDPj6mQ:UQsG7yhjYvXHBMMm1ebBgyoD0
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1712c95f679f0bbc4ff5716e158c4ac7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1712c95f679f0bbc4ff5716e158c4ac7_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
4KB