Analysis
-
max time kernel
96s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 03:33
Static task
static1
Behavioral task
behavioral1
Sample
3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe
-
Size
484KB
-
MD5
3bd9315fa824d7f8351d858ca5c12629
-
SHA1
a19b2e80a240452e4fe251a9299bd5d30b66d709
-
SHA256
20fd96b00deec9d95d0e251aa4c6885f85af415f8e776716399b4280ae8128f3
-
SHA512
6fc7405b19ae91a3ad96dc91918eb2e7c2da0e2265a79f17f096c8d2b348ede7df51e2d4a2db69e3bd5aba40ba94e52bf52b374de48c81e0566932983095b38d
-
SSDEEP
6144:Gbx0cXjCfjnhWQ+3HwOcc0WXJ4+5yk6kPFlom3iBX94AcGFCKrvvScZTHvxqVCHR:QOFPocc0WX64kmiqAcGXFZbAAt
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exepid process 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exedescription pid process target process PID 1500 wrote to memory of 1904 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 1904 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 1904 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 4392 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 4392 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 4392 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 5020 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 5020 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 5020 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 4524 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 4524 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 4524 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 1816 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 1816 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe PID 1500 wrote to memory of 1816 1500 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe 3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"2⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"2⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"2⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"2⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bd9315fa824d7f8351d858ca5c12629_JaffaCakes118.exe"2⤵PID:1816