Analysis
- max time kernel
144s - max time network
143s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/04/2024, 01:29
Behavioral task
behavioral1
Sample
9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
- Target 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe
- Size 3.8MB
- Sample240403-bwcszaca32
- SHA256 8a82d9904985c9779c317052ad31585aacdf6b745b88a5ec3a8bcb697a8e9a8d
- MD5 9c6bda87c91a4bb5b1a70a76d7fe4486
- SHA1 1732841f6f297ee0e596e36252c799922acc74ad
- SHA512 e959b556796c9d5c152a38ab94398c5c4b23522ee2c991d7587484f7899582da485aacff67bb3e4e47d47c99f6a4d235f4ab5c05de4d41880b8d55ddef4b71ec
- SSDEEP 98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/ZmlwXVZaFB:K+R/eZADUXR
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe Token: SeShutdownPrivilege 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe 3012 9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c6bda87c91a4bb5b1a70a76d7fe4486_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3012