Analysis
-
max time kernel
6s -
max time network
10s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-07-2024 08:44
Errors
Reason
Machine shutdown
General
-
Target
255199e95d485d1d595a4bbef921f852_JaffaCakes118.exe
-
Size
78KB
-
MD5
255199e95d485d1d595a4bbef921f852
-
SHA1
41faff3a966e7f6d9b1034253fd18d5b8b4cf996
-
SHA256
fb145fe4b5dbbd9e8c2e3f1da10a0718f492cd600f3c43711e0bf5ec8f26bbe1
-
SHA512
9aa1ce987d421f45a64bd15a7738120d7014f2e112698583c5c7b14abcd38d502c90985c50ae5729b50c444bb57255fb01fda5cc4221659526aca3bf5a6cc6d5
-
SSDEEP
1536:0wbzHyEWagNf5OVuopsSEOmozUlPOhwGAo6JlIK:5zSEWaMksZosPEwGAo6JlIK
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\255199e95d485d1d595a4bbef921f852_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\255199e95d485d1d595a4bbef921f852_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB