Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
24/07/2024, 00:16
General
-
Target
6988dcea793d41ba00a77d5675a703b8_JaffaCakes118.exe
-
Size
209KB
-
MD5
6988dcea793d41ba00a77d5675a703b8
-
SHA1
97edccf923900d47617b367a926f9c1ccb9a9910
-
SHA256
6ff7e2e50e953d0bfef07a9e827ae77aea5d7469199a0201baff1b59ba07c79c
-
SHA512
83b83a40ae2ea26ca54b47ce60050668e7c3877be4b3cda573e56f17d7c551c961afcf7b17e60e9392b9119790131ba3fc7611570dda0e2c7ab14a1b0814f0b8
-
SSDEEP
6144:7D/eR0r3XtcgPRUQ9rJvY23cu9QadWbSoTfIaakf:veI3nPKQ9rVt9lWFfRPf
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6988dcea793d41ba00a77d5675a703b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6988dcea793d41ba00a77d5675a703b8_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
16KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
16KB