Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe
-
Size
32KB
-
MD5
f0136ea824c786275e52ef1a9387eb71
-
SHA1
2cab4ab942ea675fdbae47b3fc82bf851aa5c2e3
-
SHA256
19fe219a293dfbaaae1d3db607c5c1cb88bfe1e20c0ac84b03f6f0de3775250e
-
SHA512
a823e356181928c3cab3d4847e902546a97365f3b8b709ee6ce80ab88271633482a073a28ad29c061a13f9ead24aa638092b954485a900565fd9eeb7df4560d0
-
SSDEEP
384:MpjGQghwLFDLR36ZTQxtnwsyN5kamlc7Dnyj1a4+dSyUTEgl0Bhqmr2WWu8lNPzg:OL36ZTQFe5fnkHVmglIrhWtNPw1dF
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3972 set thread context of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3972 wrote to memory of 3964 3972 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 89 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56 PID 3964 wrote to memory of 3464 3964 f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0136ea824c786275e52ef1a9387eb71_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3964
-
-