Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 00:31
General
-
Target
JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe
-
Size
659.0MB
-
MD5
24fd496166faa7cc4569adbabadd1a58
-
SHA1
c76350cbb7867d7959fb0e58e2543b2df07f39ef
-
SHA256
9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318
-
SHA512
412196df8393317a8fd72fbeeea7dc4e2cd5553829fd3218f65ae986df67d01eb149d90e5f8bad0289fd1ef03d1c6767d07759cf0b8d179cbc483282b8bfd970
-
SSDEEP
98304:fUuYyj3O4isajZvJJhuYdHOzFSpsip5+nKUueER+w7lnh5R1XYtrEZSR:cryrOyMZ3gYXprH+SpR+w7dZu+
Score
10/10
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
12.4MB
-
Filesize
3.2MB