Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe
-
Size
316KB
-
MD5
fe069ea99c64e346b372375ed645ae4f
-
SHA1
7c2e932580bfe02ce977377fef04bd9c31478d90
-
SHA256
fb353d0e9a0de2100c6139f77456095467ae82dca5c91132ed06bf532ec9dde9
-
SHA512
7508d9b9cfeb913a690f7814e7a7e02b3136789724a858f59e4f0310f8fb175d11f79c97eb1578643f867da200c37dc3625a1373f138277b10007c0ca489f638
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiERTIY1:FytbV3kSoXaLnToslOTP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2036 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2204 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 112 fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe 112 fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 112 fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 112 wrote to memory of 2036 112 fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe 28 PID 112 wrote to memory of 2036 112 fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe 28 PID 112 wrote to memory of 2036 112 fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe 28 PID 2036 wrote to memory of 2204 2036 cmd.exe 30 PID 2036 wrote to memory of 2204 2036 cmd.exe 30 PID 2036 wrote to memory of 2204 2036 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\fe069ea99c64e346b372375ed645ae4f_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2204
-
-