Analysis
- max time kernel
114s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/04/2024, 19:14
Behavioral task
behavioral1
Sample
ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe
- Size 10KB
- Sample240410-xxrt6sha74
- SHA256 35a40df18208e87c42d63b3ae8b45839529b48903c7cf843a2ae42fdaa7e6bd6
- MD5 ebcae4d26e09b647bbd0bc4e0e3b56a1
- SHA1 367a36eb4d3196477477108d129a33f33c0af914
- SHA512 57a66b66f1e2a28b7bfd1c24b58da5ef6bd773c8e7a3f9461490b31170cfff9308564cfc6c04eb9a0f693a96bb37e8d702fe3e7f503f23b9eeb5e8cdad38462f
- SSDEEP 192:fKMb6laJXPwmBh3koHjjsKA4tihs0eCbqZn7oJwOJ684zjMvs2UZuE0:C0xPxBFjHA4guZn7tb8H7f
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1068-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1068-1-0x0000000000400000-0x0000000000409000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1068 ebcae4d26e09b647bbd0bc4e0e3b56a1_JaffaCakes118.exe