Analysis
- max time kernel
149s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2024, 02:35
Behavioral task
behavioral1
Sample
69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
General
- Target 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe
- Size 666KB
- Sample240724-c24pbatckk
- SHA256 caed5e97f717c37e174112b62f2245c0b36f7e94e45a035995465d58b7220839
- MD5 69f0183036adf8021dd73f8b6aae5a00
- SHA1 976e872187c27433bec46dae755afd5119395002
- SHA512 ca0fe0551910374b1eae07ee72b0df28709e7838bd39b38e8ce5763081cfb05634922ec86c2ce24cf7f332d0b475787f6fbcc97f8da3554d292d55155c181096
- SSDEEP 12288:Wfbh3edoSdPDze9LBApPsKNoeP313umLcUmyqC+N/jXI0fs:kR8oYzS12PVaA3LLRHqC+ljXBs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5100 set thread context of 700 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeSecurityPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeLoadDriverPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeSystemProfilePrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeSystemtimePrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeBackupPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeRestorePrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeShutdownPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeDebugPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeUndockPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeManageVolumePrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeImpersonatePrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: 33 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: 34 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: 35 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: 36 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 700 iexplore.exe Token: SeSecurityPrivilege 700 iexplore.exe Token: SeTakeOwnershipPrivilege 700 iexplore.exe Token: SeLoadDriverPrivilege 700 iexplore.exe Token: SeSystemProfilePrivilege 700 iexplore.exe Token: SeSystemtimePrivilege 700 iexplore.exe Token: SeProfSingleProcessPrivilege 700 iexplore.exe Token: SeIncBasePriorityPrivilege 700 iexplore.exe Token: SeCreatePagefilePrivilege 700 iexplore.exe Token: SeBackupPrivilege 700 iexplore.exe Token: SeRestorePrivilege 700 iexplore.exe Token: SeShutdownPrivilege 700 iexplore.exe Token: SeDebugPrivilege 700 iexplore.exe Token: SeSystemEnvironmentPrivilege 700 iexplore.exe Token: SeChangeNotifyPrivilege 700 iexplore.exe Token: SeRemoteShutdownPrivilege 700 iexplore.exe Token: SeUndockPrivilege 700 iexplore.exe Token: SeManageVolumePrivilege 700 iexplore.exe Token: SeImpersonatePrivilege 700 iexplore.exe Token: SeCreateGlobalPrivilege 700 iexplore.exe Token: 33 700 iexplore.exe Token: 34 700 iexplore.exe Token: 35 700 iexplore.exe Token: 36 700 iexplore.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5100 wrote to memory of 700 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe 84 PID 5100 wrote to memory of 700 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe 84 PID 5100 wrote to memory of 700 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe 84 PID 5100 wrote to memory of 700 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe 84 PID 5100 wrote to memory of 700 5100 69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69f0183036adf8021dd73f8b6aae5a00_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:700
-