Analysis
- max time kernel
94s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/11/2024, 03:35
General
- Target 9254b772e035e4f08ae2c9c0d0453cf3_JaffaCakes118.exe
- Size 24KB
- Sample241124-d5rplaykan
- SHA256 c366d4aaac34ea0cb14c1ab8fd2f55e0bf328001afd258aae4686935205649e5
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9254b772e035e4f08ae2c9c0d0453cf3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9254b772e035e4f08ae2c9c0d0453cf3_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2004-0-0x00007FFDE16B5000-0x00007FFDE16B6000-memory.dmp
memory/2004-1-0x000000001B8F0000-0x000000001BDBE000-memory.dmp
memory/2004-2-0x00007FFDE1400000-0x00007FFDE1DA1000-memory.dmp
memory/2004-3-0x000000001BDC0000-0x000000001BE66000-memory.dmp
memory/2004-4-0x000000001BEE0000-0x000000001BF42000-memory.dmp
memory/2004-5-0x00007FFDE1400000-0x00007FFDE1DA1000-memory.dmp
memory/2004-6-0x00007FFDE16B5000-0x00007FFDE16B6000-memory.dmp
memory/2004-7-0x00007FFDE1400000-0x00007FFDE1DA1000-memory.dmp