Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 12:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
3 signatures
150 seconds
General
-
Target
304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
304dc46fc01db50d97d83b304b8d459b
-
SHA1
68b47a10fb096a90c1b39b979f1d43ff96f32a4b
-
SHA256
46b1b161e1e365dec038d117671617e02b1a4ee44250a731a7350778555a138a
-
SHA512
2d4bb9a62eb445fc7c6abf84dd0bf4ee9ebd3d55d8926a08b254a8480103d4d2c28b5587bcafc1e237e607809f0cc0a2218c1d2b31c250c2415b6fb3f77ecc78
-
SSDEEP
24576:hTRvnlvuFTVQWw8tbC5pAAmnRmxzKJ3gZhnWebeFrXM3AsrV5t:rlv4TV3r8DaRmxzE3mhnQFrZq
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\p12954.ini 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeSecurityPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeSystemtimePrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeShutdownPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeDebugPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeUndockPrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: SeManageVolumePrivilege 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: 33 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: 34 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe Token: 35 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2388 304dc46fc01db50d97d83b304b8d459b_JaffaCakes118.exe