Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04/07/2024, 06:42
General
-
Target
24fb950a1447624437666f7cccdadf6b_JaffaCakes118.exe
-
Size
257KB
-
MD5
24fb950a1447624437666f7cccdadf6b
-
SHA1
8e2c337a3d8e3da93d23a24741a93c26d032cff2
-
SHA256
dd488462d8cfc1e058bccc758022616e372957a0d9f921f3f7cd2eb89e6f15f1
-
SHA512
888de935b15b139ef4bd0495988f1e623c496e184d1792a3470bb3c436187a241ea9330050790da5952888f81a3fe8257222783c58929bb3f20c972d61f28b0b
-
SSDEEP
6144:51Co6nZJbHLtERqwV3wZK2x7sLK1uTtvoyc2Yt:5CXbHLDwV3wZV7sLKqtQn2K
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24fb950a1447624437666f7cccdadf6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24fb950a1447624437666f7cccdadf6b_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
-
Filesize
284KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
2.1MB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB