Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 21:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe
Resource
win7-20240903-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe
Resource
win10v2004-20240802-en
4 signatures
150 seconds
General
-
Target
d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe
-
Size
38KB
-
MD5
d07adc14d8496b5489cbf42a5ac79a52
-
SHA1
6ca222409fa04ceceb4edfd03e63b7952fa6afd4
-
SHA256
775034fa80540ef5f22b4b573dc571895c7e685f9a6e10a768b5e88bcce3f4a9
-
SHA512
21afc8fc27da1e4cdcc0abc44b36dc6820fdc139412df998c06d1802991d632ecc819702782f9391049bf7e134450202a45bf8b46c7f568cbd3e1bcac25f5690
-
SSDEEP
768:cvvbuvpjHHp5O7X//Dfq80EDB8fYnUdkmc5ZtlU/R5SyDWAjjF1sg:I87Ij/7fqjEVOYukrplUHSySq51
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\temp.tmp d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\temp.tmp d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2724 d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2724 d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2724 d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2724 d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d07adc14d8496b5489cbf42a5ac79a52_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:2724