Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 07:46

General

  • Target

    f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe

  • Size

    16KB

  • MD5

    f7e5decb2c3b5d592cd580ed8d68aa23

  • SHA1

    049e7eebd677ec5bebae0545cfa6161ab392c8c0

  • SHA256

    b523a7038662d534bd80af942685562a66e6364bf0fbf68aecf9f1131363543d

  • SHA512

    ce1e896453e10b1dc71bf6bd974caffdebb6cd37f616b6737e3fc530df20d1f3f0d22f90b7daa226db0dfe06c9d298d130448ef9cd3a006c689e01dbe31a54b9

  • SSDEEP

    384:dMRFaXOq9VxP+uGz9muhNculb5sc/Oy5h5Ct:dMRFaXOq9VERwuhNfVho

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2260-0-0x000007FEF625E000-0x000007FEF625F000-memory.dmp

    Filesize

    4KB

  • memory/2260-1-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

    Filesize

    9.6MB

  • memory/2260-2-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

    Filesize

    9.6MB

  • memory/2260-3-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

    Filesize

    9.6MB

  • memory/2260-4-0x000007FEF625E000-0x000007FEF625F000-memory.dmp

    Filesize

    4KB

  • memory/2260-5-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

    Filesize

    9.6MB