Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10/08/2024, 12:40
General
-
Target
86166e34b556f20265b88c144152b94a_JaffaCakes118.exe
-
Size
80KB
-
MD5
86166e34b556f20265b88c144152b94a
-
SHA1
621976037eb4db0b7324f95550947ca80a318163
-
SHA256
ad5b8a848bcf13ced28fc596d10c5a4806166e44088ab0cb6730ab048f477001
-
SHA512
f998321c44b7b4590da1b9aee337bb4740fac6a2d4e9546789b43a92b59e4fc42066fb05dfd2d0693ed458f778e51c58eeec7792eda2bef8c88ac93b06cb710d
-
SSDEEP
1536:I0DPHv8U7V3i7wWFzWtdkQPTDER74qc5iNCfV2iRk7Lf:JDfv86Ji8gITIxk3fVA7
Score
7/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86166e34b556f20265b88c144152b94a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\86166e34b556f20265b88c144152b94a_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB