Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-12-2024 23:13
General
-
Target
JaffaCakes118_cd9ed05240e880b36ad0cdd5bda62cba3f4bea55e69d62282030674f7a4da815.ps1
-
Size
266KB
-
MD5
b2b5da2e78b297ef26d53af784ccaf81
-
SHA1
d26490e3da6c5da661ff349824672fa93199eb81
-
SHA256
cd9ed05240e880b36ad0cdd5bda62cba3f4bea55e69d62282030674f7a4da815
-
SHA512
1ae7d55ac49177c8ea6c9f2e814194c15271d22cc37501798e6460d78cc8d93b5b4513fcdb6e963a929fa6ebae8e2e3e45eb4de244d4fdb463030d2ca4b7776c
-
SSDEEP
1536:eh/IJn60mcKfS49U4CP6tw1s4/be7p325ZTnRmbQVdeHRPl+bQUajg/wt5ph1l7Y:eK
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd9ed05240e880b36ad0cdd5bda62cba3f4bea55e69d62282030674f7a4da815.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB