Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
-
Size
395KB
-
MD5
69cdd4b211022ff4c6f152673ae9a187
-
SHA1
4a0e7e2b4ea24c15fb3a7fb9d474bc95174caa55
-
SHA256
cb39e6d0e8f98ce1d2ea3be9b320ba32c804d5c428c9057c3dda39533536194c
-
SHA512
09bb34a2be36c1834edc1e2d03b6d4a7f25fee39e449ddcada6966a5aed56e1ed31c11c42163ad6f25c88b6333deb86e19ce799027e14ca38d8ad1f0d52b015e
-
SSDEEP
6144:RsmDsQwJM5tUebn2BUgKj1LbWTcX8Jz1CjPKliegZSkY1bVJPijmiaPJRuIhpx:+ML3iLKgcXQzcTKl0atL6jBajJhpx
Malware Config
Extracted
lokibot
http://mclhk-net.com/chanelstv/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exedescription pid process target process PID 208 set thread context of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exedescription pid process target process PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe PID 208 wrote to memory of 3756 208 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe 69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/208-0-0x0000000074A02000-0x0000000074A03000-memory.dmpFilesize
4KB
-
memory/208-1-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/208-2-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/208-3-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/208-4-0x0000000074A02000-0x0000000074A03000-memory.dmpFilesize
4KB
-
memory/208-5-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/208-14-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/3756-7-0x0000000000570000-0x0000000000612000-memory.dmpFilesize
648KB