Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-12-2024 13:33
General
-
Target
JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe
-
Size
702.0MB
-
MD5
49352ed329c86996b5d1ee0a1d2bbfb1
-
SHA1
46c84bb649cc1021bff016202fdb758a05117cef
-
SHA256
b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2
-
SHA512
30d4bc2fae9f06447ff1f95467fe09d206ed6da265e591a698dfe6e4d0c02b6b3758ed0b05cb658bbde55238d77222824b59f477c5435d928cf99499d6624846
-
SSDEEP
98304:dEI1vrDktAlV4TRkhgFNicA/qFC336qEJVSdNHu1GImorT:d1p3ktUV4ligFfA/qjqqIrj
Score
10/10
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
8KB
-
Filesize
12.9MB
-
Filesize
3.3MB
-
Filesize
12.9MB
-
Filesize
12.9MB