Analysis
- max time kernel
94s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91969d4feba46d018ab997d8f378e206_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
91969d4feba46d018ab997d8f378e206_JaffaCakes118.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 91969d4feba46d018ab997d8f378e206_JaffaCakes118.dll
- Size 16KB
- Sample240603-negf2sce6v
- SHA256 ef96a6f15311f8aaf1be1825eb48a0e9b73a2a9dc2b95bc10cbda64a91f76052
- MD5 91969d4feba46d018ab997d8f378e206
- SHA1 f35d5b90ba481371402a021b31e86850c39939f1
- SHA512 7dc653e775704fdf39a5b02eabe0354ab22ed4bbf2066aa5ca269a8401e38ed063d32ddf370324f2a16b9d74af883fc8033a396f3764e9594b4914672a5b450a
- SSDEEP 192:bWlrSKy31Wk9927ySvq2L+/M2+lCB9gFau7HsgZLTj16Goxj9z6vTMGKa75FvBvs:bWx0829q5F3bTTh6GohiMGKa7vvxlL
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 1444 rundll32.exe Token: SeIncreaseQuotaPrivilege 1444 rundll32.exe Token: SeSecurityPrivilege 3196 msiexec.exe Token: SeCreateTokenPrivilege 1444 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 1444 rundll32.exe Token: SeLockMemoryPrivilege 1444 rundll32.exe Token: SeIncreaseQuotaPrivilege 1444 rundll32.exe Token: SeMachineAccountPrivilege 1444 rundll32.exe Token: SeTcbPrivilege 1444 rundll32.exe Token: SeSecurityPrivilege 1444 rundll32.exe Token: SeTakeOwnershipPrivilege 1444 rundll32.exe Token: SeLoadDriverPrivilege 1444 rundll32.exe Token: SeSystemProfilePrivilege 1444 rundll32.exe Token: SeSystemtimePrivilege 1444 rundll32.exe Token: SeProfSingleProcessPrivilege 1444 rundll32.exe Token: SeIncBasePriorityPrivilege 1444 rundll32.exe Token: SeCreatePagefilePrivilege 1444 rundll32.exe Token: SeCreatePermanentPrivilege 1444 rundll32.exe Token: SeBackupPrivilege 1444 rundll32.exe Token: SeRestorePrivilege 1444 rundll32.exe Token: SeShutdownPrivilege 1444 rundll32.exe Token: SeDebugPrivilege 1444 rundll32.exe Token: SeAuditPrivilege 1444 rundll32.exe Token: SeSystemEnvironmentPrivilege 1444 rundll32.exe Token: SeChangeNotifyPrivilege 1444 rundll32.exe Token: SeRemoteShutdownPrivilege 1444 rundll32.exe Token: SeUndockPrivilege 1444 rundll32.exe Token: SeSyncAgentPrivilege 1444 rundll32.exe Token: SeEnableDelegationPrivilege 1444 rundll32.exe Token: SeManageVolumePrivilege 1444 rundll32.exe Token: SeImpersonatePrivilege 1444 rundll32.exe Token: SeCreateGlobalPrivilege 1444 rundll32.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1444 rundll32.exe 1444 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1440 wrote to memory of 1444 1440 rundll32.exe 82 PID 1440 wrote to memory of 1444 1440 rundll32.exe 82 PID 1440 wrote to memory of 1444 1440 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91969d4feba46d018ab997d8f378e206_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91969d4feba46d018ab997d8f378e206_JaffaCakes118.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1444
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196