Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe
-
Size
248KB
-
MD5
b9015d7005917e7b3b7dd9e46471e597
-
SHA1
d8a3ba08a7e163135a0a1bcc0a5963f936e659b2
-
SHA256
16ce5561a44924ae8299cac899ed24c212d93a7b273a183a5a66880769424b18
-
SHA512
99d90f41c54b2c903dec8037d23702396c5950a03a1b8825202c2e47d775dcf1bd346f356e5739ab5c54fbae7f5ac4c70089e21f94daf20e17607b9e0c496f3d
-
SSDEEP
6144:p08ln3ce15OV6K4zf2xWOL+jHBlTQB+xWHyGLc:pL5qQ+xWOLIHBlTc+xgc
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
aboooooooooooooos.zapto.org
Signatures
-
Latentbot family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6} JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = " Restart" JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2024 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe Token: SeDebugPrivilege 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe Token: SeDebugPrivilege 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe Token: SeDebugPrivilege 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe Token: SeDebugPrivilege 2024 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe Token: SeDebugPrivilege 2024 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88 PID 4888 wrote to memory of 4368 4888 JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:4368
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9015d7005917e7b3b7dd9e46471e597.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2024
-