Analysis
-
max time kernel
12s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 19:12
Behavioral task
behavioral1
Sample
131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe
-
Size
745KB
-
MD5
131bb4461a6f2d9ca512443202f79b7a
-
SHA1
4f40877885f93d1fc7a67465daaa973a211c8a13
-
SHA256
49e386f2c5b9930219e802111fa2e52cc29345ab5ca5cf05bbe5242be381625f
-
SHA512
3f3c7613d16373faaf20956c08a39a0f55dff55c6da1043a75916e608b783256d0dc5d60be63889db282ed2541ff20f9d5c24a9754d7ceebc37013810b8507fc
-
SSDEEP
12288:96A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTvf2wqMd0QZh9u:wAmBpVKHu0Mu9Xo20VGLVvOwD0QZh9u
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSecurityPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSystemtimePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeBackupPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeRestorePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeShutdownPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeDebugPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeUndockPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeManageVolumePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeImpersonatePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: 33 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: 34 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: 35 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSecurityPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSystemtimePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeBackupPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeRestorePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeShutdownPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeDebugPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeUndockPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeManageVolumePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeImpersonatePrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: 33 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: 34 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe Token: 35 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exepid process 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe 2936 131bb4461a6f2d9ca512443202f79b7a_JaffaCakes118.exe