Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 08:47
General
-
Target
eaf957fed02fc143802d3eff11d4dddf_JaffaCakes118.ps1
-
Size
1.4MB
-
MD5
eaf957fed02fc143802d3eff11d4dddf
-
SHA1
ce04e0cbca0fd7e1abe322a7f94a7eb01ddf72cb
-
SHA256
6a86727505f9aacbb6e9d67445b8e99d23e37d9db46a737e1b2c72274332cb41
-
SHA512
ae164f196583f7a2a6b12a902fa118e30a0f653700c30aa17ab97219b9c5f6eaaad3f765fab89b6ff5da48b521f283c45c73e20d38e76ff6c2c55f99b82df612
-
SSDEEP
12288:zJW/kYR3J9bXwjnA7fUL64zJuk8q0UmA1NzENYgnBKPqSY29oPtrPN4In5VreTCf:fs/vQL4uY
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\eaf957fed02fc143802d3eff11d4dddf_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
336KB
-
Filesize
9.6MB
-
Filesize
9.6MB