Overview

overview

7

Static

static

7

423dc12a8b...18.exe

windows7-x64

1

423dc12a8b...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    141s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 15:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    423dc12a8b97da08d737359e154c2562_JaffaCakes118.exe

  • Size

    360KB

  • MD5

    423dc12a8b97da08d737359e154c2562

  • SHA1

    a6aeb41cfd25c828485080b5f649ba15b8d33265

  • SHA256

    56a55b09e87d3dae31b33b4bc67ce4d0e6ea68599451c7eda7dadb23aab85cce

  • SHA512

    7a475017f6b1a1df66427124624264d9265aa80e4990b4e61a056621a228198c11ce7ee448c0ccb2fc6fcea20a66b53898c690ccbf1e2a5a21cfcf4eb205ff4f

  • SSDEEP

    6144:yo0arPfWlX9pVr9UqbBeLXU5wtMjaE4afL2mwczrCza0qFL65s:yo0arHq9lIhtMjV42L2mfPCO5FLh

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3508
      • C:\Users\Admin\AppData\Local\Temp\423dc12a8b97da08d737359e154c2562_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\423dc12a8b97da08d737359e154c2562_JaffaCakes118.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4476

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4476-0-0x0000000000400000-0x0000000000508000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/4476-1-0x0000000000400000-0x0000000000508000-memory.dmp

            Filesize

            1.0MB

            Download