Analysis
-
max time kernel
142s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 16:24
General
-
Target
be3c179f97c8409ccfb3e932cf95092d_JaffaCakes118.exe
-
Size
181KB
-
MD5
be3c179f97c8409ccfb3e932cf95092d
-
SHA1
1c9343f7fdb2c3332cb060d1cbeb8a927611315b
-
SHA256
60401aa45839a9aba33de1161e8cdba74ac8e8b90f721151b534c45cdc044461
-
SHA512
6f267dac16666f02a21ba98255cf825cae2bfdb77b60aa580aca26e5ad5d8ed74662e702d8d27afe82389372c92f34d4f67fb0fa82deac7deef8102a17ca70be
-
SSDEEP
3072:zcFbqzk5h9NAY/WMKjmYa33PsrNjf4N5kjJGL52DmnFMz3pP95CYwFnjED:IFbqzk4Meml3PsrNENGvCyzx
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\be3c179f97c8409ccfb3e932cf95092d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\be3c179f97c8409ccfb3e932cf95092d_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
32KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB