Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 07:46
Behavioral task
behavioral1
Sample
f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe
-
Size
16KB
-
MD5
f7e5decb2c3b5d592cd580ed8d68aa23
-
SHA1
049e7eebd677ec5bebae0545cfa6161ab392c8c0
-
SHA256
b523a7038662d534bd80af942685562a66e6364bf0fbf68aecf9f1131363543d
-
SHA512
ce1e896453e10b1dc71bf6bd974caffdebb6cd37f616b6737e3fc530df20d1f3f0d22f90b7daa226db0dfe06c9d298d130448ef9cd3a006c689e01dbe31a54b9
-
SSDEEP
384:dMRFaXOq9VxP+uGz9muhNculb5sc/Oy5h5Ct:dMRFaXOq9VERwuhNfVho
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 2 0.tcp.ngrok.io 4 0.tcp.ngrok.io 10 0.tcp.ngrok.io 21 0.tcp.ngrok.io 32 0.tcp.ngrok.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2260 f7e5decb2c3b5d592cd580ed8d68aa23_JaffaCakes118.exe