Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe
-
Size
168KB
-
MD5
d5aa54d4d8343f1cd994189707d5a734
-
SHA1
88f410dee7b64d7c754374fc78417add7f13e849
-
SHA256
5c957f3c0373b20e9bc29472376bbe2383b3f66e76761a0c6e52895e3907f667
-
SHA512
81f6e84877fec2f97646b2a3277db4aaf81f2db6da1274269db9772b64fd1657188de162d7d0c17a6383f407e4096ae1dfc96660ba34a257f27e64c621e4767d
-
SSDEEP
3072:RWEnTaB3HQXbZXi/KhSK6yeFGm/s+vDCQDnBaaSTustFUoUWUMgkWW4:RWEn8ARiC4dR/DNDnB5STDtFUoZ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shvutilman.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe 2116 shvutilman.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeShutdownPrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3912 wrote to memory of 2116 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe 86 PID 3912 wrote to memory of 2116 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe 86 PID 3912 wrote to memory of 2116 3912 d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5aa54d4d8343f1cd994189707d5a734_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\shvutilman.exe"C:\Windows\SysWOW64\shvutilman.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116
-