Overview

overview

3

Static

static

3

4572b696de...18.exe

windows7-x64

1

4572b696de...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    125s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2024, 10:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4572b696de166f07914fb6cc976aaa62_JaffaCakes118.exe

  • Size

    215KB

  • MD5

    4572b696de166f07914fb6cc976aaa62

  • SHA1

    3db696fb6398864acbc39e3595a9b7621cdcfba1

  • SHA256

    287d54ff4ddff3271212b7d614a3481746d8d4a45410242baa3a6f4bec8343f5

  • SHA512

    83812540252e25309243fae8d4efa4e7b9a00b5669592725671b980e27b7be7a267f4fb71d9106124f82917a36b303927be87cfb11a038cf3e6fe42981ad178a

  • SSDEEP

    3072:w7qELGRF6YwxM0Jyvq+xJYZj+w7dDe2eW3Mz6cwms/yP/dGxbLp+bRfEySaziidg:zRFtc+slJDIW8q/1xbsfEyT1doY

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4572b696de166f07914fb6cc976aaa62_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4572b696de166f07914fb6cc976aaa62_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3044-0-0x0000000074F21000-0x0000000074F22000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3044-1-0x0000000074F20000-0x00000000754CB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3044-2-0x0000000074F20000-0x00000000754CB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3044-3-0x0000000074F20000-0x00000000754CB000-memory.dmp

    Filesize

    5.7MB

    Download