Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/08/2024, 03:42
General
-
Target
ba3881f4ac889c6cb43b9f2e7be18bd8_JaffaCakes118.exe
-
Size
21KB
-
MD5
ba3881f4ac889c6cb43b9f2e7be18bd8
-
SHA1
1b11229d605d8fdf125fd1373012ae376872afd0
-
SHA256
d0b78247fb3043793fa97dd704433712b7ca43cbddc3ca9092330f67a0c92233
-
SHA512
a71bdfb0d2d914d4676bf643adabb5c85288fb78d7006351a9a19695f129a8659c4b4887de95d627ce759f39feb4fc4ee0374c0d48134d889fb8031e49d36da8
-
SSDEEP
384:l3ZLjCsBTuohyN2d05tjLAwi0Pf2Nt+ZT8WU/xXeNnCvSAicQbKy:l35CsBHyAwnPf91U/WNc
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba3881f4ac889c6cb43b9f2e7be18bd8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ba3881f4ac889c6cb43b9f2e7be18bd8_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
36KB
-
Filesize
60KB