Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 06:59 UTC

General

  • Target

    2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe

  • Size

    567KB

  • MD5

    2f638bbf1afac418ff54d0b41fb46f94

  • SHA1

    666f45633710b57a9350a8ce2f534d505245dd37

  • SHA256

    abe206d59751496351baa7b7b6408c1263bee203cfddcaf7d48e31f62a0b4939

  • SHA512

    cfb81c94749848047e1fb62195517b1aff30880ec170e76c9ce85683d75803c9ff0e38168b21bfe2fc92d428948bd769ced6c81dcfbe8290e214dea63f935e1c

  • SSDEEP

    12288:+OLtXrAYDLH9tK1q5mUo4K55Ke4ao4X0k/NBcDOnH:TUYD7fKkIcKjKvBGnnH

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4408

Network

  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4408-11-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-3-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-0-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-23-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-63-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-162-0x0000000077832000-0x0000000077833000-memory.dmp

    Filesize

    4KB

  • memory/4408-163-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-253-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-145-0x0000000077832000-0x0000000077833000-memory.dmp

    Filesize

    4KB

  • memory/4408-144-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-61-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-59-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-57-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-53-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-51-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-49-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-47-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-45-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-41-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-39-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-29-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-27-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-25-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-21-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-19-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-18-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-15-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-13-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-9-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-8-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-5-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-1-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-55-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-43-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-37-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-35-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-33-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

  • memory/4408-31-0x0000000000570000-0x00000000005C2000-memory.dmp

    Filesize

    328KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.