Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
28/06/2024, 06:43
General
-
Target
19290de9604594276607bdf254be7fd8_JaffaCakes118.exe
-
Size
597KB
-
MD5
19290de9604594276607bdf254be7fd8
-
SHA1
993e1d6db21bf295694f0485caef86d1c1cc54dd
-
SHA256
31708616d8a8582940790df0b3e28972baa9aa27ae75f92700cb2eed051066fe
-
SHA512
eb8b8e5b7f4636319fd1e5e9d49da1d6cffc978e241583ffe8f9c6015f5ff5ee7033bd60c96ee44bbdc52aa0318700d0d322c7162dc1001026c6cdcd390a0eba
-
SSDEEP
12288:Q2CKE3JI2PhihwvC64xo6F3Z4mxxsDqVTVOC4zP:Q26dYEGo6QmXLVTz4z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19290de9604594276607bdf254be7fd8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19290de9604594276607bdf254be7fd8_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
-
-
C:\Windows.com.cn.exeC:\Windows.com.cn.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597KB
MD519290de9604594276607bdf254be7fd8
SHA1993e1d6db21bf295694f0485caef86d1c1cc54dd
SHA25631708616d8a8582940790df0b3e28972baa9aa27ae75f92700cb2eed051066fe
SHA512eb8b8e5b7f4636319fd1e5e9d49da1d6cffc978e241583ffe8f9c6015f5ff5ee7033bd60c96ee44bbdc52aa0318700d0d322c7162dc1001026c6cdcd390a0eba
-
Filesize
218B
MD5801c0ea81254420886ad87a45c1fb841
SHA18a90d2906975b82fba4966935b18e2a16b43eb32
SHA2568547bacf49c3aa314d3dc84ef109f7b458d635b9b922d477916419d5231830cb
SHA5124c8d14aa0583f976b294e9975e09ec620860bf296e2fe90adffd75bbfbed3bde5a12cd13f1627301d8b816d3529144d2eef85dcf201c050d1ad43332248cd29a
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
336KB