Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28/06/2024, 02:17
General
-
Target
186dcfa1557131867d063e0d6bc953b1_JaffaCakes118.exe
-
Size
166KB
-
MD5
186dcfa1557131867d063e0d6bc953b1
-
SHA1
fdf357212eb3a534e86663e0a5c5cca54c04f5b0
-
SHA256
c0a902d16d9d2c215e66bd0c7df062fb20f92eea6ff78d993e68d61bea00036e
-
SHA512
5317449c27678a369246e576da3346dccf5fe26d7282ed2eaddf98ecb6e2c487f42524ab355426c308f36fad68e4f2a68450880b023e35914424275e3abedea0
-
SSDEEP
3072:m3cfQcyqAuYEkF68MrS3zW4YrUoYTR02TIeE+KrIYRzay+l5nacz6VKA0j:xQcyHzVzv/TkuSGyizbA
Score
7/10
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\186dcfa1557131867d063e0d6bc953b1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\186dcfa1557131867d063e0d6bc953b1_JaffaCakes118.exe"2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
16KB
-
Filesize
48KB
-
Filesize
4KB