Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 05:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
237dcba926f68d809230a71529172e4c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
237dcba926f68d809230a71529172e4c_JaffaCakes118.exe
-
Size
364KB
-
MD5
237dcba926f68d809230a71529172e4c
-
SHA1
350ef285178655aa95e49b51957ec14d9e36ba78
-
SHA256
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949
-
SHA512
8dd34cf5c04c8d2de31338da1abed2dbb0474f99198330fbe69a5a0f37a3027ccf70ea4d9647447477d1a1d446dfc621ab834b95117b8bcd67ed1cf18f047b30
-
SSDEEP
6144:CbiAcw/EX+wGuJaFZpDb3u8zh+QKbbvQpUhXVf7S6jrJyqp9xYsMgiN:C+tHX+wMZpDbVz6aUh57SjCMgG
Malware Config
Extracted
Family
zloader
Botnet
Raz
Campaign
Raz
C2
http://softwareserviceupdater5.com/web/post.php
Attributes
-
build_id
35
rc4.plain
rsa_pubkey.plain
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1988 created 3432 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 57 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4416 set thread context of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 1988 set thread context of 3124 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 104 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe Token: SeDebugPrivilege 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe Token: SeSecurityPrivilege 3124 msiexec.exe Token: SeSecurityPrivilege 3124 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 4416 wrote to memory of 1988 4416 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 95 PID 1988 wrote to memory of 3124 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 104 PID 1988 wrote to memory of 3124 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 104 PID 1988 wrote to memory of 3124 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 104 PID 1988 wrote to memory of 3124 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 104 PID 1988 wrote to memory of 3124 1988 237dcba926f68d809230a71529172e4c_JaffaCakes118.exe 104
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\237dcba926f68d809230a71529172e4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\237dcba926f68d809230a71529172e4c_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\237dcba926f68d809230a71529172e4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\237dcba926f68d809230a71529172e4c_JaffaCakes118.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
-
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124
-