Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 03:49
Static task
static1
Behavioral task
behavioral1
Sample
14936e9908801feebce7196616cec7ef_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
14936e9908801feebce7196616cec7ef_JaffaCakes118.exe
-
Size
640KB
-
MD5
14936e9908801feebce7196616cec7ef
-
SHA1
211299faec8f23dde85def610d71a82ad947dd82
-
SHA256
21f113e52ffb24537afb897e358a20397139f41e984800ea462ce8596bc9b30c
-
SHA512
a605ff20e7bb0cc573133729895697056128afc18b0bc3a15ca8fccad99a6581ddc928398cb200d18111ff1477ae1faee5082452adf7c0fdb21462f7933de3d8
-
SSDEEP
12288:re/P9QSFF2bNk/HEKYM7X489Z5cN6Q3J1KUOuGao0NoEVem50TLM:aX9QyF2bNgEM7487aN6QXusPjGc
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
14936e9908801feebce7196616cec7ef_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeSecurityPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeSystemtimePrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeBackupPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeRestorePrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeShutdownPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeDebugPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeUndockPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeManageVolumePrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeImpersonatePrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: 33 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: 34 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: 35 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe Token: 36 2464 14936e9908801feebce7196616cec7ef_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2464-0-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/2464-1-0x00000000009A0000-0x00000000009EE000-memory.dmpFilesize
312KB
-
memory/2464-2-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-9-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-8-0x00000000759D0000-0x00000000759D1000-memory.dmpFilesize
4KB
-
memory/2464-7-0x0000000002650000-0x0000000002660000-memory.dmpFilesize
64KB
-
memory/2464-6-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2464-5-0x0000000077952000-0x0000000077953000-memory.dmpFilesize
4KB
-
memory/2464-4-0x0000000002300000-0x0000000002310000-memory.dmpFilesize
64KB
-
memory/2464-3-0x0000000002650000-0x0000000002660000-memory.dmpFilesize
64KB
-
memory/2464-10-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-14-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-13-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-12-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-11-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-15-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-16-0x00000000009A0000-0x00000000009EE000-memory.dmpFilesize
312KB
-
memory/2464-17-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-19-0x0000000002300000-0x0000000002310000-memory.dmpFilesize
64KB
-
memory/2464-22-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-21-0x0000000002650000-0x0000000002660000-memory.dmpFilesize
64KB
-
memory/2464-20-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2464-18-0x0000000002650000-0x0000000002660000-memory.dmpFilesize
64KB
-
memory/2464-23-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-27-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-26-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-25-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-24-0x00000000759B0000-0x0000000075AA0000-memory.dmpFilesize
960KB
-
memory/2464-28-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-29-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-30-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-31-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-32-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-33-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-34-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-35-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-36-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-37-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-38-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2464-39-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB