Overview

overview

4

Static

static

3

27949e2dc8...18.exe

windows7-x64

1

27949e2dc8...18.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-07-2024 06:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    27949e2dc84360f28d56904131b0b952_JaffaCakes118.exe

  • Size

    46KB

  • MD5

    27949e2dc84360f28d56904131b0b952

  • SHA1

    516c157fe6ec01fb83be690b54249ef57f618edb

  • SHA256

    de1b5655fe0adf3c765f59e8caa0a681156be85f3256a99f837fb931d3d0d80e

  • SHA512

    d8b390c88d837b77981de3366cb7daec3229e243f44e2ed7c5285239eb06ac577bef90cad440e69c1176a32b5dbdd053e759497fe5229dace14dbde2f1748d06

  • SSDEEP

    768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ41Yq:Yyx9mkr0G+hGYVj9wbcqZe1f

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27949e2dc84360f28d56904131b0b952_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\27949e2dc84360f28d56904131b0b952_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1444-0-0x0000000000400000-0x000000000040BB90-memory.dmp

    Filesize

    46KB

    Download

  • memory/1444-1-0x0000000000400000-0x000000000040BB90-memory.dmp

    Filesize

    46KB

    Download