Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 09:59
Behavioral task
behavioral1
Sample
JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe
-
Size
815.4MB
-
MD5
8d09a44d7b7ecdc7acb2aad0376a38c6
-
SHA1
91ba128382958716bae664ff0af101da6d44be3c
-
SHA256
85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918
-
SHA512
4afa4befb406bf174384869b9514a5e74a4ce6b1d3f5978d9fec42ca2d04487f17661fd817caa14725f309844d3b0879861eb503521a30ec72ca25ff64218b2a
-
SSDEEP
98304:cTxPupJkmHmooywZfLGc6D6yT+nHZH6JnIRLfZNlT3/Msj:cTAkaoBxLc6lnHZH6Y/Msj
Malware Config
Signatures
-
Raccoon Stealer V2 payload 1 IoCs
resource yara_rule behavioral1/memory/2460-1-0x0000000000390000-0x0000000000C06000-memory.dmp family_raccoon_v2 -
Raccoon family
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/2460-1-0x0000000000390000-0x0000000000C06000-memory.dmp net_reactor behavioral1/memory/2460-4-0x0000000002730000-0x00000000027BE000-memory.dmp net_reactor behavioral1/memory/2460-5-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-6-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-32-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-44-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-8-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-60-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-10-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-12-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-14-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-16-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-18-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-20-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-22-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-24-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-30-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-34-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-40-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-48-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-52-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-62-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-68-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-66-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-64-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-58-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-56-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-54-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-50-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-46-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-42-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-38-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-36-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-28-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor behavioral1/memory/2460-26-0x0000000002730000-0x00000000027B8000-memory.dmp net_reactor -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2460 set thread context of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31 PID 2460 wrote to memory of 7148 2460 JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:7148
-