Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11/07/2024, 05:07
General
-
Target
37cf70bc7ad16cbc6dcb41935364d529_JaffaCakes118.exe
-
Size
744KB
-
MD5
37cf70bc7ad16cbc6dcb41935364d529
-
SHA1
68d12ffb95d9ba118cd8d588d24ae832726ec0e7
-
SHA256
0374cf555dd02735cffaace8b2945ef69a7c678d4d43a9b6eba2615f43ff4a13
-
SHA512
8912447af94c6f947c70572203c0365310f054eaccbd97c18bd89b13da3018285badede7eda403e2e9cbca83592f75dc25d8d3ba9564d3310891c70842d6c1b6
-
SSDEEP
12288:1Ry8S++U4u/n/80dW5A0zyR6JwQ5oAlK+Gbpv5TIkQbQQ52LYRg08yPwrRlt:/BMU4ufxdW5A2FJr/khpvZIkQ33Y
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37cf70bc7ad16cbc6dcb41935364d529_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37cf70bc7ad16cbc6dcb41935364d529_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Hacker.com.cn.exeC:\Windows\Hacker.com.cn.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
MD537cf70bc7ad16cbc6dcb41935364d529
SHA168d12ffb95d9ba118cd8d588d24ae832726ec0e7
SHA2560374cf555dd02735cffaace8b2945ef69a7c678d4d43a9b6eba2615f43ff4a13
SHA5128912447af94c6f947c70572203c0365310f054eaccbd97c18bd89b13da3018285badede7eda403e2e9cbca83592f75dc25d8d3ba9564d3310891c70842d6c1b6
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
4KB