Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 09:05
Behavioral task
behavioral1
Sample
1bc160f03046481d45e4c82923311412_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
1bc160f03046481d45e4c82923311412_JaffaCakes118.exe
-
Size
202KB
-
MD5
1bc160f03046481d45e4c82923311412
-
SHA1
bdf0c599149bb97669ebdfda7a6a7c318c789e9c
-
SHA256
a7604712a13adc362220cb29fa9e63240d54ae239a03366ac9d67f885f8bd558
-
SHA512
43eaf2962a1eab470ad6e0e94d9a436a87fc6a9946c403d234f03af6ae275df8b4722d1513e527aa05eecdb032d49a284c414a6744dd2f62d06f77223a7a8fc0
-
SSDEEP
6144:QLV6Bta6dtJmakIM5JgCpVBVl30m8A2CSFixQft:QLV6Btpmk8gqv3ftEFnft
Malware Config
Signatures
-
Processes:
1bc160f03046481d45e4c82923311412_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1bc160f03046481d45e4c82923311412_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1bc160f03046481d45e4c82923311412_JaffaCakes118.exepid process 2296 1bc160f03046481d45e4c82923311412_JaffaCakes118.exe 2296 1bc160f03046481d45e4c82923311412_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1bc160f03046481d45e4c82923311412_JaffaCakes118.exepid process 2296 1bc160f03046481d45e4c82923311412_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1bc160f03046481d45e4c82923311412_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2296 1bc160f03046481d45e4c82923311412_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc160f03046481d45e4c82923311412_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1bc160f03046481d45e4c82923311412_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2296