Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 21:37
General
-
Target
JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe
-
Size
685.0MB
-
MD5
096dc1fabe1ad64b3e2396c8e6aa4fca
-
SHA1
2038df7cae2b236982d1acc5ce9314dcf1132ed0
-
SHA256
a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f
-
SHA512
58f66cd7bc84b860b2c43059effd5e299f2493730ed88d5f1cb2381bf73d71d9cdabd26d6d986ee930bfb60fbdfb8b45336522d864e85300012c72a1e1200cf3
-
SSDEEP
196608:PhXPU493Ffe2lrHmPvq4+tocAgGYqBsb2N:PlM4ZZe2pKL8o1USN
Score
10/10
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
13.9MB
-
Filesize
3.8MB