Analysis
-
max time kernel
2s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
11/07/2024, 02:43
Errors
Reason
Machine shutdown
General
-
Target
3766c1b91a9d810478cc3f7b44a55edf_JaffaCakes118.exe
-
Size
104KB
-
MD5
3766c1b91a9d810478cc3f7b44a55edf
-
SHA1
9021b26cd0095869d65aa98e155bc26c5c8be8a3
-
SHA256
54e786c92b3edc78e5fa9ff1cf70fa893d7d170ec11c6e3751ab2283d888aea9
-
SHA512
0767ffbc83d0dec46ac08cf952e3454eb4154cd70d40c7b8de82259dbfb9479fa809bc5481a0e47b99dc3e4c30eb2f64c2750645074c38890ac305c1ff6c9537
-
SSDEEP
1536:ElVV4V4Z9N0zWigDUwxvk0p+gaDWGhGTf6g0CSceu+nBgyoDPj6mQ:8fIJzW/IwafU1iQebBgyoD0
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3766c1b91a9d810478cc3f7b44a55edf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3766c1b91a9d810478cc3f7b44a55edf_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
4KB