Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 03:03
General
-
Target
eef438334b116b3bc32126a46ab72767_JaffaCakes118.exe
-
Size
166KB
-
MD5
eef438334b116b3bc32126a46ab72767
-
SHA1
320b9d27183cb32a55bd7efe6ddc62c12d202297
-
SHA256
f25952a9652b2aa565c769a640318b2bc485a13862d8b94b02495d4c37bb2193
-
SHA512
066915d8b5d4e14a72f641d737e7354e31464690ef42de12f1c6fa2e6242ccf60411e4b68ac7c831ddcbe510912611c3220fe9a190a7fb4b4f26d36297211757
-
SSDEEP
3072:U1wojz1hwuXvEf6BYFaN50ziYa9KYcu6nl4eKiLcLcal46+Afa:U2ojzcuXsf6BYAYziYa9b6nlpKA+4Rc
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\eef438334b116b3bc32126a46ab72767_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eef438334b116b3bc32126a46ab72767_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
24KB