Analysis
- max time kernel
149s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 02:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
- Target 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe
- Size 707KB
- Sample240509-c5dmasea6v
- SHA256 3e5ef2d4dacc38aff93222a029b60c504ed41b10de6a8cac312cce6a628854a8
- MD5 27e51992cb36ef9f88d394e91eb3696c
- SHA1 073442cb2116cbd6e2b8fc530e39050a75b3e8f3
- SHA512 0e739c485bf485d3365544b9a584615bc1f8e39bfe6267401a029463f4a7ff90ee72afa6a8db5c3a9e3848cc987b6d3e61f085bf18f89afcdee82d14d88afa67
- SSDEEP 12288:E3pzVHgopJkemMSNaNyVyreJTPnt8NIu5P/ohxzQe18OLRX3YZc6RbHn:+z9gopFmMSNagUGTPnt8Nx5Yhx9ltsX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: 33 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 464 27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27e51992cb36ef9f88d394e91eb3696c_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:464