Analysis
- max time kernel
92s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
14/07/2024, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
- Target 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe
- Size 758KB
- Sample240714-dssfcsxbrc
- SHA256 6e8be6d2b13ac4f4a7e4a94f338efb133bc70069cb446e64003151d1fc19106b
- MD5 4411276ead884bd736d3b38e3a5252c7
- SHA1 3ef6ce6bd519152ffc101b93c11bc958c22cfa94
- SHA512 9de3f8f17af7f8c72f8fd24e2944ec5c9c1a78e840bcec85402c6ea6ee6d96a5acd9d19307890e291ad4a84b82188860225d803f5976512ce47baa10e1d841ec
- SSDEEP 12288:oxGwXJLo2caCllqpx+IWaqhSiAOy9HM4vhJhyL2yelPGXZgCyolk3+xePi:oxxo5epwIh0Sp917AguXCChk4eK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4452 set thread context of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 664 set thread context of 2788 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 87 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe iexplore.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeSecurityPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeLoadDriverPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeSystemProfilePrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeSystemtimePrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeBackupPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeRestorePrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeShutdownPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeDebugPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeUndockPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeManageVolumePrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeImpersonatePrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: 33 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: 34 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: 35 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe Token: 36 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 2788 iexplore.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 4452 wrote to memory of 664 4452 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 86 PID 664 wrote to memory of 2788 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 87 PID 664 wrote to memory of 2788 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 87 PID 664 wrote to memory of 2788 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 87 PID 664 wrote to memory of 2788 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 87 PID 664 wrote to memory of 2788 664 4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4411276ead884bd736d3b38e3a5252c7_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2788
-
-