Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-07-2024 04:22
General
-
Target
249db3f2d9c3d304bf16a42425861a83_JaffaCakes118.exe
-
Size
830KB
-
MD5
249db3f2d9c3d304bf16a42425861a83
-
SHA1
12c28f737f489609c60808e8160aa0d45aca7e59
-
SHA256
47d87759dadcbdfcea9e61f68c848e60b10b5663e5cd4a373e34eb932af42435
-
SHA512
58870420f819230c3e89359a4633687e6355071edc5c11289fea01e4678692b3b177c3ff98c6c3c5f3c04bf028c35a8bdd92b6253e6ae329d76389083d3813bb
-
SSDEEP
24576:+VcZROjvGHkFkU04NWdfccZROjvGHkFkU04NWn0D3:+VcZ8j+044NWGcZ8j+044NW0D
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Disables Task Manager via registry modification
-
Drops desktop.ini file(s) 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\249db3f2d9c3d304bf16a42425861a83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\249db3f2d9c3d304bf16a42425861a83_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
856KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB