Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
- Target 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe
- Size 707KB
- Sample240526-sy2csabc3w
- SHA256 bc67f221a2b879c923bd1ce6703b632e10d1447ab156696f1cbb1849682e56df
- MD5 75f0c1e5d5f6c25bbb6cd476bd15ee46
- SHA1 f7285cca0f9d1237be8789b3db7ab9049b579c79
- SHA512 327b94f9eb452875ef5da913bdd3eb0bc92c4585f96c00354cb33ba3329b3dc8f0e9c2a6fcb53ec21ff57c58fd18023739741466592bd1e5b37ee9a1cadf1f87
- SSDEEP 12288:G3pzVHgopJkemMSNaNyVyreJTPnt8NIu5P/ohxzQe18OLRX3YZc6RbHn:cz9gopFmMSNagUGTPnt8Nx5Yhx9ltsX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: 33 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2124 75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75f0c1e5d5f6c25bbb6cd476bd15ee46_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2124