Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-11-2024 05:15
General
-
Target
b4f0e994975bff7dfe20011baba4be64_JaffaCakes118.exe
-
Size
6KB
-
MD5
b4f0e994975bff7dfe20011baba4be64
-
SHA1
2a46f25dc1773def752911f529bb6599fa9d2036
-
SHA256
c98b2589823c4121f2a01845d9863017da7f5e7ca4b7d82de3ceedb9f3fd284e
-
SHA512
7ee627337e2332dddf0018c7bcc2fe84658b66f928a73fe480a0b1e16138b6afd4de75ec04b0137c27969c0c55b22ec8622ad421c7459cb21b9e0d4c44bc8af6
-
SSDEEP
96:cu+jgv9t6YKhJefCZnMKS68Fp844xmb7KrKks2YvlkjF0/ym9ovuxcTlbMdtWV1T:Hv9ZKhJcI88mfhUQ6x06m9onytVap
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4f0e994975bff7dfe20011baba4be64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4f0e994975bff7dfe20011baba4be64_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken