Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 19:00
Behavioral task
behavioral1
Sample
deb5d7db2d412ffd830ade622561d486_JaffaCakes118.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
deb5d7db2d412ffd830ade622561d486_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
deb5d7db2d412ffd830ade622561d486_JaffaCakes118.exe
-
Size
16KB
-
MD5
deb5d7db2d412ffd830ade622561d486
-
SHA1
e3456c0cd8290e5e1f1922968249bbeb9d31e3fa
-
SHA256
7bf399fd2232c77977014fb0089ee9c6b987c8833a6dbfbd33ec5c5e2c34ee6e
-
SHA512
82b2ee91ae3d31d1daabca4ee074bc3751748be1002e0dc26aea6db5d65c8dcc349d455c0155382da6bca11ee551de6777a6d24605f72cbc0c1e0e6df5366b9f
-
SSDEEP
384:dpi1PKtl50TsQb9muhNculb5sP34yu5Ct:dpi1PKtlM9wuhNf9o
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 5 0.tcp.ngrok.io 26 0.tcp.ngrok.io 42 0.tcp.ngrok.io 56 0.tcp.ngrok.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 740 deb5d7db2d412ffd830ade622561d486_JaffaCakes118.exe