Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
05-07-2024 14:10
General
-
Target
26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe
-
Size
30KB
-
MD5
26f6b3d4cfd885e6be9519b4b93698da
-
SHA1
295c5d995323c41426f34b3fd074e55b66a94a17
-
SHA256
b3e60b276c70ad9795d149edaae19f67718dfd22beda2ccc8cd8ed9ef9281125
-
SHA512
49de1f2149727b770f194a7ab6ae1bbc48c5e1f6ec99e5288a25a5c85b04c2a900d741f524c25572e72b2b6973efa5421b5d7c0668047687f10cbb1ab5e3edbe
-
SSDEEP
384:xoGOuBoKjkcCrBnkbRxJK7SThq38HDIWbEd/cbH6olytd4NBNXKXu8Ett8/Qq8R:eH9BkQ8HTJH7QD4NnMvG8/Q1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\26F6B3~1.EXE > nul2⤵
-
-
C:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exeC:\Windows\SysWOW64\26f6b3d4cfd885e6be9519b4b93698da_JaffaCakes118.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD526f6b3d4cfd885e6be9519b4b93698da
SHA1295c5d995323c41426f34b3fd074e55b66a94a17
SHA256b3e60b276c70ad9795d149edaae19f67718dfd22beda2ccc8cd8ed9ef9281125
SHA51249de1f2149727b770f194a7ab6ae1bbc48c5e1f6ec99e5288a25a5c85b04c2a900d741f524c25572e72b2b6973efa5421b5d7c0668047687f10cbb1ab5e3edbe
-
Filesize
4KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
308KB