Analysis
-
max time kernel
6s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
12-07-2024 08:06
Errors
Reason
Machine shutdown
General
-
Target
3c988d32cd5032071b04c6be3e136037_JaffaCakes118.exe
-
Size
79KB
-
MD5
3c988d32cd5032071b04c6be3e136037
-
SHA1
d51d83cb0be034d3fe1aa48117c0d3c2ada5b902
-
SHA256
64c9734767c75d4d0a20e1a4966d89694486ad1994a3e39fb2c7f876baaa606e
-
SHA512
175fe3d12b647b226d77596b4ae59d5de156584e45670e24ad9cc79276afa140fb805ed209b78b5fd453765e0bc5acbbcc2f0bb1d9a5548357490d48184efc80
-
SSDEEP
1536:M41eZFE2Ih2Dz5zKFYGRXznbnSRpJ4F0FpRODBStVPonJlIK:MF1yUFEL3SRjhFpaSLPonJlIK
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c988d32cd5032071b04c6be3e136037_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c988d32cd5032071b04c6be3e136037_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
4KB