Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe
Resource
win7-20240903-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe
Resource
win10v2004-20241007-en
0 signatures
150 seconds
General
-
Target
54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe
-
Size
5KB
-
MD5
54532c7e4f8ab087848db97c84295438
-
SHA1
a706d8a70ffc89044db36951ceb8e0a08dd19d67
-
SHA256
e06a1e2b0627e5b667dbd3ec53cec6fb031f1327c788c54e31e5391fd5dd556e
-
SHA512
285c68f9835a35e5b325321f2130cfa46950d8cebd78c014e0066dfb81bcd681ef491334e31b1582949b75167a10c24c4e6966146cbcfa343a6985c4c1e32b5d
-
SSDEEP
96:nBAI3qqBrZBeWHVSxNkl09a828iutESjYLVQweXdrVz5/YoXzVSQdh+Nvn:QMSxN3g8xtvjoVoVz5/YoXxdgvn
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\secure32.html 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe File opened for modification \??\c:\Program Files\paytime.exe 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\hosts 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2508 54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54532c7e4f8ab087848db97c84295438_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508