56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 20:00

Target

e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe
Size

16KB
MD5

e0ee27afb4f7265a4d4459db6a4d6c04
SHA1

22f327c88557888de0e3051b803574b36b165f39
SHA256

56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc
SHA512

664d38c7fb0dc768c8d06d454383cf0a85238bc2d68250d9ec9bbc52da7d2d0c4ea8919df5cfc53808ae7e2f41e8415aaa7812823cb9d71fa3d616ca12061bec
SSDEEP

384:r2ZilPqtlJES8ur9k4NcKlb5suLUyp5Ct:r2ZilPqtlFrlNzpo

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

Processes:

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	2176	e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1996,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:3864

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/2176-0-0x00007FFC75255000-0x00007FFC75256000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x00007FFC74FA0000-0x00007FFC75941000-memory.dmp

Filesize
9.6MB

Download
memory/2176-2-0x000000001C360000-0x000000001C82E000-memory.dmp

Filesize
4.8MB

Download
memory/2176-3-0x000000001BD60000-0x000000001BE06000-memory.dmp

Filesize
664KB

Download
memory/2176-4-0x000000001C8F0000-0x000000001C952000-memory.dmp

Filesize
392KB

Download
memory/2176-5-0x00007FFC74FA0000-0x00007FFC75941000-memory.dmp

Filesize
9.6MB

Download
memory/2176-6-0x00007FFC75255000-0x00007FFC75256000-memory.dmp

Filesize
4KB

Download
memory/2176-7-0x00007FFC74FA0000-0x00007FFC75941000-memory.dmp

Filesize
9.6MB

Download