Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2024 01:29

General

  • Target

    d0cc6f4a785501054e414fadd9d4ef7e_JaffaCakes118.exe

  • Size

    54KB

  • MD5

    d0cc6f4a785501054e414fadd9d4ef7e

  • SHA1

    1449e8a8c07a853fcc9c10b20a8ef14b9d50e9ac

  • SHA256

    dfc0cd4a502ce6243494c0588fab96f209b4299922011dba363f3d56a7d49459

  • SHA512

    7e0ce492cbffa8e4e8d938ac1e5d1e2e58a87e365dfc9c47da8a6e76c4dc2d41716725d0b97414376e08a28fd3a9e91815358e7d55517fbb13bb48306d2a5d89

  • SSDEEP

    768:h1JNkqtdL24Mzkd+XKtRH9AJjdfUIvw1EgDkANntYCpfBPx5yUWEViDFsLF9+cka:Hkk9IkYKPHe5re91GCplxHyug

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\d0cc6f4a785501054e414fadd9d4ef7e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d0cc6f4a785501054e414fadd9d4ef7e_JaffaCakes118.exe"
        2⤵
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1204-4-0x0000000002AF0000-0x0000000002AFA000-memory.dmp

      Filesize

      40KB

    • memory/2720-0-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2720-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

      Filesize

      4KB

    • memory/2720-5-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB