Analysis
-
max time kernel
105s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 01:39
General
-
Target
JaffaCakes118_8a3862f5518733bb9074a258d3ad6af9.exe
-
Size
100KB
-
MD5
8a3862f5518733bb9074a258d3ad6af9
-
SHA1
8b517d1db0735f2e5f47051fd61d7ee8e7079180
-
SHA256
2bb767093044b28574dbc83797c542f322ef254a80ea0731b27865a7e5cdbee3
-
SHA512
bbe59d5d7a6d502698bd380d89372ada5cf6f16f37bac028200cf091fafd5d87a3d5b839ce756ebfb0d5310ec2bd6e68f9d95254c7fc1b377615604ea4d62bc6
-
SSDEEP
1536:Qcj5vSfPY6uKj/CON5yotqdOtOp5bh0BoIDaE3xq2KhVUQO4ZN57VwTd:Qcj5GfuTuyoIau590BoIhhaBzZD7cd
Score
7/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Drops file in System32 directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3862f5518733bb9074a258d3ad6af9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3862f5518733bb9074a258d3ad6af9.exe"1⤵
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB