Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118.dll
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118.dll
-
Size
235KB
-
MD5
21dc58f20aa515ac6ac166eb37a76ef5
-
SHA1
cde06e8e9715f105448a35b602730483cd1fb082
-
SHA256
8a02574cbd506aa2607223fa567ef6a107c065c5fe970180c8afb4e9ccd088ab
-
SHA512
f4013e5c29d55243543e62f5581206be1acbdc3ef3cf4b5ad8de19d0fbd008d464d3ed30fcb3485a75bb6f395ed3c9ce347048d4e7bd45fc2b9d7f56331d672a
-
SSDEEP
6144:5PISNDkrK1IK3hEnkDUxc2CIoatal+Qtal+u:5PISNA8R/gxcBatal+Qtal+u
Score
8/10
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118.dll" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe 2120 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe Token: SeBackupPrivilege 2120 svchost.exe Token: SeDebugPrivilege 2120 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1972 2236 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes118.dll2⤵
- Server Software Component: Terminal Services DLL
PID:1972
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k 21dc58f20aa515ac6ac166eb37a76ef5_JaffaCakes1181⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120