Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 20:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
962ae24141e7b1abf36ae99d1fbc7315
-
SHA1
bff36581aae1b402d2542190d89faf07fcdd2680
-
SHA256
61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba
-
SHA512
46f9e98ad3440d8fa079ca7431face86ddf46850de4ee7f5c220ac1fa4738646a6862e0895797d83e52f9b1f24117b7259ac33b02405ac72f0135e8ff33e1072
-
SSDEEP
24576:196uxv82aMVxkN0m9KYR665AoUv8xmlBp49Ax5v7WPDFIgY:19zjalOm046IArUqi9A7v6ZIJ
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-2-0x0000000004810000-0x000000000494E000-memory.dmp family_zgrat_v1 -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exepid process 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exedescription pid process target process PID 2156 wrote to memory of 2652 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2652 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2652 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2652 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2312 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2312 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2312 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2312 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2388 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2388 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2388 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2388 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2396 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2396 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2396 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2396 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2404 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2404 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2404 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2404 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2448 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2448 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2448 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2448 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2452 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2452 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2452 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2452 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2460 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2460 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2460 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2460 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2284 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2284 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2284 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2284 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2936 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2936 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2936 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe PID 2156 wrote to memory of 2936 2156 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe 962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe2⤵PID:2936