Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 22:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe
Resource
win10v2004-20240412-en
4 signatures
150 seconds
General
-
Target
f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe
-
Size
41KB
-
MD5
f46d78b8479b9a6725033ef735592f29
-
SHA1
eb3f8e5b69b10b69981eb393196e271647915e09
-
SHA256
e62afa50e544b603860a2c27a9b9acd68406f2166d70c0ec8f5a0444a3fcb068
-
SHA512
ae0bd8d90d11230457431e967f1fb24a60db9e61794ed3783783f95cb76a4e8877be54e522eb40331cae214ff7425d64b5609e40fb1a141f384ad79175b6fd2e
-
SSDEEP
768:WpPNrGptLp1p2pZpnpaply9yo/cpI1gkuebVSzO9uf9shtN:+PVOtFX+zp6lg/caluebV+OYY
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 448 f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe 448 f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe 448 f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe 448 f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 448 f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 448 f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
PID:448