Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/08/2024, 04:13
General
-
Target
c835a548aa46a6ca1b0b10b1bb846119_JaffaCakes118.exe
-
Size
56KB
-
MD5
c835a548aa46a6ca1b0b10b1bb846119
-
SHA1
278fcc1b4e37b73f951e7b1abcae851a8254f709
-
SHA256
d540bdb94e2a6dcf645dbccb2e35405e4312fd417de7b0b1668ec929ddb57920
-
SHA512
211cfa5b206db72701255081d5d410c214d64fd7840e2ce4fbbf7a6e30eddf78f3151a814e359537987374db0c19bc0348aef8a82096b40b1915589417864d99
-
SSDEEP
768:AyHxe3EdeqdC/dddVR0syVaC0G6pYgq/SzdgVd4hGvBQolqW9QW9z6hc6XUYH81L:nHbtANmMC0G6Yz/9LZltOW9z3MmN/
Score
7/10
Malware Config
Signatures
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c835a548aa46a6ca1b0b10b1bb846119_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c835a548aa46a6ca1b0b10b1bb846119_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5001⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB