Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240729-en -
resource tags
arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2024 19:40
Behavioral task
behavioral1
Sample
5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118.exe
Resource
win10v2004-20240729-en
2 signatures
150 seconds
General
-
Target
5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118.exe
-
Size
16KB
-
MD5
5bcbe8f7299bcd8e63f34def74b24b72
-
SHA1
e320580d43588a2276b5da3e076a25daac6f8155
-
SHA256
038391b2020f10bc643e322fd0f668af217f5415c1f030454080bf34fcae538f
-
SHA512
92e810178b86055014d3c57853a2f3257e833ebb0a175b5b4fc6acd75f2ee9aa98c22eb265986fa372bdd588a2dced6a3cf43173dccb9a43e22df3c1161b81e2
-
SSDEEP
384:1ZilPqtlJES8Zr9muhNculb5sBEiy05Ct:1ZilPqtlFUwuhNfYo
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 27 0.tcp.ngrok.io 32 0.tcp.ngrok.io 39 0.tcp.ngrok.io 43 0.tcp.ngrok.io 1 0.tcp.ngrok.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4540 5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118.exe