Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
15/07/2024, 16:57
General
-
Target
4a92b54b6b53a694c865c4071933f8bf_JaffaCakes118.exe
-
Size
410KB
-
MD5
4a92b54b6b53a694c865c4071933f8bf
-
SHA1
d5abfdd1b94dee910e8b56c6b1ad2a52b90266d1
-
SHA256
6dfe8d9ce8d131a23e33447dbb3656232e54f4b276022e96fd28c24d28dd6eeb
-
SHA512
956b36b3207c5b6124928a27f6f4f765f194a1c587effef96ab4e44b8f948f4002aa093b42dbf53e1f4e87cd2229014ba1d371c7b11dcc2888433c51705f79bc
-
SSDEEP
12288:QPHqJonCaD5dXmyllzke1vtd4d8gkDukSO4:QPKwD5dXmyH/1Fd4dDkDuX
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a92b54b6b53a694c865c4071933f8bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a92b54b6b53a694c865c4071933f8bf_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\qq.exeC:\Windows\qq.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
410KB
MD54a92b54b6b53a694c865c4071933f8bf
SHA1d5abfdd1b94dee910e8b56c6b1ad2a52b90266d1
SHA2566dfe8d9ce8d131a23e33447dbb3656232e54f4b276022e96fd28c24d28dd6eeb
SHA512956b36b3207c5b6124928a27f6f4f765f194a1c587effef96ab4e44b8f948f4002aa093b42dbf53e1f4e87cd2229014ba1d371c7b11dcc2888433c51705f79bc
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB