8d65dee17a45e8f144df50cbfab6a12010ed5db34b0447c3e15729608827dab2 | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:58

Sharing

Report Analysis Logs

General

Target

2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
Size

54KB
MD5

2125b435e065ed4576810a64e5f50293
SHA1

0d2906bd8fbd0f4140384bbc3ffaafae21a8ddbd
SHA256

8d65dee17a45e8f144df50cbfab6a12010ed5db34b0447c3e15729608827dab2
SHA512

9795cfc994bf494fd00488336a26161ed8e5ef59df77522d90b34b1c5a0d6a3368331a674448cc86ccaae5816de2ea3abfb946c384e1d59e65d40a0a75f1cdc4
SSDEEP

1536:poMB4oy7pkr6C+RYWTORUI5DODt8PqPmI:GMVTWSOt8Pq+I

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2060	2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads