Analysis

  • max time kernel
    150s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 02:26

General

  • Target

    5eada7a60bd04ee4c713669135316a95_JaffaCakes118.exe

  • Size

    268KB

  • MD5

    5eada7a60bd04ee4c713669135316a95

  • SHA1

    c8b3649cf0f9352b4b300ca1b1b45aabf58bf554

  • SHA256

    2a3cb8eeeab06ac56d7083a3d741494586a43383b3e4114fd6d054773bf5783e

  • SHA512

    70cf68a34023324ac82b5a320273a660e80d93f54a3178b41d1f7eac5d974e1dc06200f207a10417131992235a1f063094e1b2c488646ec6034b35721823d77b

  • SSDEEP

    6144:glsVPh5XL+87XmGxWP6oYE/eLmHWYk6bpZWBNSgqJ7J:gq/rmGgP6OwmHWVEAsrJ7

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5eada7a60bd04ee4c713669135316a95_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5eada7a60bd04ee4c713669135316a95_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1332
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4f4 0x2f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1332-0-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

    Filesize

    12KB

  • memory/1332-2-0x0000000002270000-0x0000000002271000-memory.dmp

    Filesize

    4KB

  • memory/1332-3-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-4-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-5-0x00000000001D0000-0x00000000001D3000-memory.dmp

    Filesize

    12KB

  • memory/1332-6-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-7-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-8-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-9-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-10-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-11-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-12-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-13-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-14-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-15-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-16-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/1332-17-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB