Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 14:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe
-
Size
75KB
-
MD5
8ac0e5508191a837e255caccbfb788f8
-
SHA1
c32aa246d95b816e8035ba5980b0244d1704be8e
-
SHA256
e04d62e001b68509047324a73082f47e3421daf80abc3f29bcb7bbede153d5bd
-
SHA512
1286564f2e5560b56839c641490d112b889368be2634e610fff0f62bf94c73c7b891caa52a6944f51b9457b6d59875108e3bcbb5f56b790b23e16b6cb61a3bc3
-
SSDEEP
1536:pCsLh3UwC7y2/fPQ1bXtbvY6vweq/cGCW7rNVMzA7:pQFFHQ1BbHu0G59VMz
Score
6/10
Malware Config
Signatures
-
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "kdrlg.exe" 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kdrlg.exe 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kdrlg.exe 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2312 set thread context of 2364 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeSecurityPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeSystemtimePrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeBackupPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeRestorePrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeShutdownPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeDebugPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeUndockPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeManageVolumePrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeImpersonatePrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: 33 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: 34 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: 35 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe Token: 36 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2252 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 85 PID 2312 wrote to memory of 2252 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 85 PID 2312 wrote to memory of 2364 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 86 PID 2312 wrote to memory of 2364 2312 8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ac0e5508191a837e255caccbfb788f8_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe2⤵PID:2252
-
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe2⤵PID:2364
-