Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
22/07/2024, 13:12
General
- Target 634def6fa1358414f8a1ffbe87c30cc1_JaffaCakes118.exe
- Size 111KB
- Sample240722-qfnymayemf
- SHA256 14fbb65fbccc1a461adf5911da07ae765e3c1da87d1b2f61616bc96f7c8182ef
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\634def6fa1358414f8a1ffbe87c30cc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\634def6fa1358414f8a1ffbe87c30cc1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ec 0x4b81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
BASSMOD.dll
memory/2468-4-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-5-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-6-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-7-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-8-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-9-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-10-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-11-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-12-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-14-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-16-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2468-18-0x0000000010000000-0x000000001003E000-memory.dmp