Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13-09-2024 22:34
General
-
Target
df058309d13c72e968fd2d3b93f9886e_JaffaCakes118.ps1
-
Size
45KB
-
MD5
df058309d13c72e968fd2d3b93f9886e
-
SHA1
52cc14d2c2d1fb7ebb30edbae8fb5297713f330b
-
SHA256
4f503f1368c34f047e2a402052d53a8f275309f416f0f4e6eb3b6340d54af946
-
SHA512
c8f14d198e33a27608ee0b4fe03e2386a43bf9a2fd772f7078479eb49226dd2f21922bd3fea9e76d837167ec94b693d0eaa6030aca7fd9ea2ba18b0b4a677fcf
-
SSDEEP
384:OqsPIo1MvgYmAKz6b6u/Ohx22qSoYDBHUaz+dObbMtQJsyhZVERpcZxMyh01bHcz:SPugYmpcSQ25HUJDpFR6cVT/8llz
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\df058309d13c72e968fd2d3b93f9886e_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
4KB