Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 17:29
General
-
Target
JaffaCakes118_2c26039e56dba8c87aca750768323254.exe
-
Size
436KB
-
MD5
2c26039e56dba8c87aca750768323254
-
SHA1
ef23c40945cfa3ffe59902f94196f3d09fb7b06a
-
SHA256
2ccba5a40f9a6081b2c08be0f88af0c787ce93283769953ef2f1379d2bba24ec
-
SHA512
eb36f9915ceea23b48dd518041c6d475d225c689eb53c985dc8aefd152cc8ea7516a881d9e71c947a8b2bc09766b36d402f12d2852f0d4cc6354e69151d8dfec
-
SSDEEP
12288:Yqiirq+B7QakRRVf2pHQfoMP38ZMdAR1mTyz2:YqrrnB7vkd2pHQfrP38ZlR1Zz2
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c26039e56dba8c87aca750768323254.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c26039e56dba8c87aca750768323254.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 13962⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
9.6MB