Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe
-
Size
420KB
-
MD5
ad6d253dd790b3a7effaf0cae6792043
-
SHA1
98e9b716d9e6415ff4b345a0012b3d552f7617fa
-
SHA256
ca3e0f104f1e9ce6acbdb7cddb86f2194edf95fee9d8870b028e5d42b47c53b5
-
SHA512
5e2025160073c900d6d6053f5884dab9f06b6866acb8900d60a04474dc206810ce56dc802f7e4d3b65484e2c8cc4c59438db86e79a30b534f92c4bbb142e1334
-
SSDEEP
6144:y0FGuIH5LBHng5HakjpCvOVIuhJG+EzkB7RF6v6tZ:yuIZNga+498JG+EzkB7RF6v6D
Malware Config
Extracted
Family
latentbot
C2
nyandcompany.zapto.org
Signatures
-
Latentbot family
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\taskmgr.exe = "C:\\Users\\Admin\\AppData\\Roaming\\taskmgr.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2560 reg.exe 2748 reg.exe 332 reg.exe 1956 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeCreateTokenPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeLockMemoryPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeMachineAccountPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeTcbPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeSecurityPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeSystemtimePrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeBackupPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeRestorePrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeShutdownPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeDebugPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeAuditPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeUndockPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeSyncAgentPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeManageVolumePrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeImpersonatePrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: 31 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: 32 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: 33 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: 34 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe Token: 35 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1396 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 30 PID 2160 wrote to memory of 1396 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 30 PID 2160 wrote to memory of 1396 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 30 PID 2160 wrote to memory of 1396 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 30 PID 2160 wrote to memory of 2364 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2364 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2364 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2364 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2684 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2684 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2684 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2684 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2688 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 34 PID 2160 wrote to memory of 2688 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 34 PID 2160 wrote to memory of 2688 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 34 PID 2160 wrote to memory of 2688 2160 ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe 34 PID 2364 wrote to memory of 2560 2364 cmd.exe 39 PID 2364 wrote to memory of 2560 2364 cmd.exe 39 PID 2364 wrote to memory of 2560 2364 cmd.exe 39 PID 2364 wrote to memory of 2560 2364 cmd.exe 39 PID 2684 wrote to memory of 2748 2684 cmd.exe 41 PID 2684 wrote to memory of 2748 2684 cmd.exe 41 PID 2684 wrote to memory of 2748 2684 cmd.exe 41 PID 2684 wrote to memory of 2748 2684 cmd.exe 41 PID 1396 wrote to memory of 332 1396 cmd.exe 40 PID 1396 wrote to memory of 332 1396 cmd.exe 40 PID 1396 wrote to memory of 332 1396 cmd.exe 40 PID 1396 wrote to memory of 332 1396 cmd.exe 40 PID 2688 wrote to memory of 1956 2688 cmd.exe 42 PID 2688 wrote to memory of 1956 2688 cmd.exe 42 PID 2688 wrote to memory of 1956 2688 cmd.exe 42 PID 2688 wrote to memory of 1956 2688 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:332
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ad6d253dd790b3a7effaf0cae6792043_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskmgr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskmgr.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskmgr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskmgr.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1956
-
-