Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2024 17:52
Behavioral task
behavioral1
Sample
ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe
-
Size
94KB
-
MD5
ad20e1224543b112798a78072d565fbe
-
SHA1
7f3c040a09458cb2b98fc5a2b5efd2667a235964
-
SHA256
3f0e4f7e60b42179c150a88c7f860df7f69bb97d4304477ab126219f635c11e3
-
SHA512
67068d5b5050c416eaeef479b02bde810763d2e11f487aafd3c506a69d6d9712e2bafe9fd47bb66d5f467aef7acc2241fca1ba3597bc0709fbc09221af5a7e8a
-
SSDEEP
1536:sskKNqRSQ911QzZWqdFjR/MlLsesF8tFOHhy352LU6QNyyvJChhf2n5uROIMxZcF:ss9NUSKbeZWcF2gqgk3scyMohV2n5cOs
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
mouhamed007.zapto.org
Signatures
-
Latentbot family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{3G4L2686-J4L1-X5MV-12RE-JFH5V38F5030} ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3G4L2686-J4L1-X5MV-12RE-JFH5V38F5030}\StubPath = "C:\\Windows\\system32\\New.exe Restart" ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\s = "C:\\Windows\\system32\\New.exe" ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Ha = "C:\\Windows\\system32\\New.exe" ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\New.exe ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\New.exe ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1268-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1268-16-0x0000000000400000-0x000000000043B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe Token: SeDebugPrivilege 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe Token: SeDebugPrivilege 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe Token: SeDebugPrivilege 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83 PID 1268 wrote to memory of 3260 1268 ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ad20e1224543b112798a78072d565fbe_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:3260
-