Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
22/07/2024, 00:58
Behavioral task
behavioral1
Sample
6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
- Target 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe
- Size 716KB
- Sample240722-bbhtgswdnr
- SHA256 bf68720b681b9dcb2a7cec416160edf38dfa07b66ceb709b283612335a9ed026
- MD5 6224f0fd40a3b3b2e15c77af1db2d2c7
- SHA1 5dadbb4e0922cfe2eeaaf59290dab3865378685e
- SHA512 9d357dbf5ae6315eb80cbf86007c0cfccbb51339bddcadffd89682a5d638bff838671dfa0b0409fbdc7584b166904bafb4027d924e24508a0b441a35f96f85f5
- SSDEEP 12288:t8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/R:+UKoN0bUxgGa/pfBHDb+y1LR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4008-0-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4008-3-0x0000000000400000-0x00000000004B5000-memory.dmp upx - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4008 set thread context of 3824 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe 85 - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeSecurityPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeSystemtimePrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeBackupPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeRestorePrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeShutdownPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeDebugPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeUndockPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeManageVolumePrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeImpersonatePrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: 33 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: 34 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: 35 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: 36 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3824 iexplore.exe Token: SeSecurityPrivilege 3824 iexplore.exe Token: SeTakeOwnershipPrivilege 3824 iexplore.exe Token: SeLoadDriverPrivilege 3824 iexplore.exe Token: SeSystemProfilePrivilege 3824 iexplore.exe Token: SeSystemtimePrivilege 3824 iexplore.exe Token: SeProfSingleProcessPrivilege 3824 iexplore.exe Token: SeIncBasePriorityPrivilege 3824 iexplore.exe Token: SeCreatePagefilePrivilege 3824 iexplore.exe Token: SeBackupPrivilege 3824 iexplore.exe Token: SeRestorePrivilege 3824 iexplore.exe Token: SeShutdownPrivilege 3824 iexplore.exe Token: SeDebugPrivilege 3824 iexplore.exe Token: SeSystemEnvironmentPrivilege 3824 iexplore.exe Token: SeChangeNotifyPrivilege 3824 iexplore.exe Token: SeRemoteShutdownPrivilege 3824 iexplore.exe Token: SeUndockPrivilege 3824 iexplore.exe Token: SeManageVolumePrivilege 3824 iexplore.exe Token: SeImpersonatePrivilege 3824 iexplore.exe Token: SeCreateGlobalPrivilege 3824 iexplore.exe Token: 33 3824 iexplore.exe Token: 34 3824 iexplore.exe Token: 35 3824 iexplore.exe Token: 36 3824 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3824 iexplore.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4008 wrote to memory of 3824 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe 85 PID 4008 wrote to memory of 3824 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe 85 PID 4008 wrote to memory of 3824 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe 85 PID 4008 wrote to memory of 3824 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe 85 PID 4008 wrote to memory of 3824 4008 6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6224f0fd40a3b3b2e15c77af1db2d2c7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3824
-