56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 20:00

Target

e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe
Size

16KB
MD5

e0ee27afb4f7265a4d4459db6a4d6c04
SHA1

22f327c88557888de0e3051b803574b36b165f39
SHA256

56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc
SHA512

664d38c7fb0dc768c8d06d454383cf0a85238bc2d68250d9ec9bbc52da7d2d0c4ea8919df5cfc53808ae7e2f41e8415aaa7812823cb9d71fa3d616ca12061bec
SSDEEP

384:r2ZilPqtlJES8ur9k4NcKlb5suLUyp5Ct:r2ZilPqtlFrlNzpo

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

Processes:

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	2568	e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/2568-0-0x000007FEF664E000-0x000007FEF664F000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download
memory/2568-2-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download
memory/2568-3-0x000007FEF6390000-0x000007FEF6D2D000-memory.dmp

Filesize
9.6MB

Download