Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14-07-2024 12:12
General
-
Target
45c2f39aa4bb5b88dfa997e55a6f4dd7_JaffaCakes118.exe
-
Size
290KB
-
MD5
45c2f39aa4bb5b88dfa997e55a6f4dd7
-
SHA1
713d71ca9a99b9e14fdc31527dd03151deb0a3ab
-
SHA256
b93fe2d061d574e64e459814ad0b689a9ca2549325dc2c4e125823dd2922fda5
-
SHA512
1523bd72b71a536a5d9d31fd7f3dbc4fd9ebbc2724b0278b6ec11034fbffc664e1cc7cfa6dc0cb40678cad42203579622fea3a89bf2c7e99c53184ce4d68c79f
-
SSDEEP
6144:MVDIykF3mQt0fZv9YC5fn+aCyIK3ccnMxj6YClOa:MhedmUWY2W1K3DnsZCc
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c2f39aa4bb5b88dfa997e55a6f4dd7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45c2f39aa4bb5b88dfa997e55a6f4dd7_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x41c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB