Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-07-2024 18:38
General
-
Target
4ae99a9a90e5f175aa8328eefc7c4707_JaffaCakes118.exe
-
Size
64KB
-
MD5
4ae99a9a90e5f175aa8328eefc7c4707
-
SHA1
f3a5d3f83897038e523c59c5d1ca7f28a4f4ead0
-
SHA256
7a894ec2d8f91384d276d674db3496bdd0fdb1cc738e80d8af49a82f29104f41
-
SHA512
b7bab3507864f348408b6edef50da1598783a8affc22ad931be56c31a7f0da6945da503eab0296d7989a2cbc474ef5b9ae1b8dd36704fdb44e7c8a06b03b66c0
-
SSDEEP
768:MTF1+bODJeYX6jX3M6LmqL/fa2QKxJFOc+j+G2SJs4vXLCN/krEEatNAG:MJ1+gJk7jL/i2QKxblJG9JtvXLjRatJ
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae99a9a90e5f175aa8328eefc7c4707_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ae99a9a90e5f175aa8328eefc7c4707_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx