Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
d4ffe7d1c2730dd73145bcd1a10ed023
-
SHA1
43e6ede026ce6d4a14c63f5f883846dd487f7d2b
-
SHA256
abd09d21de3f2be757b451933cf9533f2abb0c598f3a6ed45ef786b4835bb5dc
-
SHA512
4a9055f08f50bcd0e8029f1f2a2d756cbc5f9b017cf57e52cb6fd51f6e5b58579bf363e7c0ce57db9dfe49ac5f345a4fb7883918117c3a53c8ee5e90215685e3
-
SSDEEP
24576:NVPSbCedGHIKbxjVLMp3OwN0x5m0/2Iyiv7pC3IMn48q1yk6KKjlANCn1u:NVKPde12gm0ZyKpC4dl0bl/1u
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe Token: SeDebugPrivilege 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 920 d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4ffe7d1c2730dd73145bcd1a10ed023_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:920