Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
15-07-2024 20:36
General
-
Target
4b4d1ce315f78cc9475934f5e1251f4a_JaffaCakes118.exe
-
Size
19KB
-
MD5
4b4d1ce315f78cc9475934f5e1251f4a
-
SHA1
09b2d9499d9f1a23467c3f95ca830ba0657f79b9
-
SHA256
dcae78be09362f839147ecd368fba0b85940af9d1e832fb2c735ba9247cd4ac5
-
SHA512
2542ea434cc09f2e66700de8c49aaca1552a2dc5e0fbf26bc9ebd7787f73ffbe2a751d3d51e710c4177d2ca3c96aa49da50985c2f21c0177ed8fd68918c22fe1
-
SSDEEP
384:pXuIa3hZGN11WLdf3hRj5dEkkqtbku8nw:p+d3G31WLdZRj57bku8nw
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4b4d1ce315f78cc9475934f5e1251f4a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b4d1ce315f78cc9475934f5e1251f4a_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD50c8bcaa1637ac2d5fe8a40fc61c8ce10
SHA1313bd19492da3eb8cd4842b982ca66cca1624458
SHA2561eb510307556d1ed46457852404fcc35aa3ab2f4aae8ea118076f12fa1a06252
SHA5128ab978603c3addf4b5b67f2cddc5bc0d22c13858a7402ca88a7a8a857808f5915a7bce845874548fa72016e17888349691292ae6e5a461f97eb5c792d8110f7a
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
24KB
-
Filesize
28KB
-
Filesize
24KB