Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 11:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe
-
Size
39KB
-
MD5
45f139e8bbb689b188d17e55d0dca22f
-
SHA1
322af0a74e4d750170a4aca067446df69d186a78
-
SHA256
984328a414d599a273176939ab8022dcbab814b929dc9d9ff1b77d939014d652
-
SHA512
44ae713b1803251bc8bb7965e0785301bbd76b80b5b65f0b8e9df16bf0f1c2ea07efe1c51a10a33d8647ab0c1d6854d44e268cf7b8292806cb9414b60bf1c96b
-
SSDEEP
768:KOxZOgIryM1P3oO2y8UN2ivcTTJlu71TFA9nn0OjDDdmo/SK2OURvXZX38mZUaFy:nSgy19JSVO1ONn511/tivXZnVGas
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2192 hvlbb.exe 2864 nbjxfpb.exe 2996 xrtxp.exe 2608 nthjlr.exe 2292 fxfxhn.exe 2636 rhhdjd.exe 2740 vdjnpb.exe 2532 rhjprb.exe 2376 jdvdl.exe 2868 pxhrvt.exe 1652 fjddrxr.exe 1396 lnbbr.exe 1188 tbvtxp.exe 1916 prhrt.exe 2588 vtfbrpf.exe 2540 tdjhp.exe 2040 bvbfx.exe 1636 bbhdf.exe 1800 nrdtb.exe 2032 lpxprtb.exe 1128 pvxxx.exe 2352 bhxhhbd.exe 2908 trrprdn.exe 800 bvjthdb.exe 324 lfhpxn.exe 1708 hjpjxrp.exe 2812 lrjlt.exe 2280 nrphvb.exe 2156 pppddp.exe 2196 pblxfxh.exe 632 bdhxp.exe 1552 fhdntp.exe 1616 fvnfv.exe 1544 xndlhr.exe 2284 nlvth.exe 1992 vrtlrl.exe 2556 hrbbtr.exe 2916 bnblb.exe 1684 thbnd.exe 1772 tjlfd.exe 1728 tvfnr.exe 1704 brxhd.exe 2888 pfvbt.exe 2680 hvvrd.exe 3032 rbhnnb.exe 2492 dptnrrn.exe 2668 jdvjxpl.exe 2524 nltlh.exe 2604 bblbnr.exe 2592 lvrftlt.exe 2684 ddnbdf.exe 2232 hnhlhl.exe 2368 dnjprlp.exe 1964 xbrfjhv.exe 1696 ddnlj.exe 1592 plnvhxh.exe 548 ptxbphn.exe 1384 vpbjd.exe 884 jxrttl.exe 880 hnllf.exe 1200 hjfjxrd.exe 2584 pbdflx.exe 2596 frttx.exe 2540 hrhhxhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2192 2888 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 28 PID 2888 wrote to memory of 2192 2888 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 28 PID 2888 wrote to memory of 2192 2888 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 28 PID 2888 wrote to memory of 2192 2888 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 28 PID 2192 wrote to memory of 2864 2192 hvlbb.exe 29 PID 2192 wrote to memory of 2864 2192 hvlbb.exe 29 PID 2192 wrote to memory of 2864 2192 hvlbb.exe 29 PID 2192 wrote to memory of 2864 2192 hvlbb.exe 29 PID 2864 wrote to memory of 2996 2864 nbjxfpb.exe 30 PID 2864 wrote to memory of 2996 2864 nbjxfpb.exe 30 PID 2864 wrote to memory of 2996 2864 nbjxfpb.exe 30 PID 2864 wrote to memory of 2996 2864 nbjxfpb.exe 30 PID 2996 wrote to memory of 2608 2996 xrtxp.exe 31 PID 2996 wrote to memory of 2608 2996 xrtxp.exe 31 PID 2996 wrote to memory of 2608 2996 xrtxp.exe 31 PID 2996 wrote to memory of 2608 2996 xrtxp.exe 31 PID 2608 wrote to memory of 2292 2608 nthjlr.exe 32 PID 2608 wrote to memory of 2292 2608 nthjlr.exe 32 PID 2608 wrote to memory of 2292 2608 nthjlr.exe 32 PID 2608 wrote to memory of 2292 2608 nthjlr.exe 32 PID 2292 wrote to memory of 2636 2292 fxfxhn.exe 33 PID 2292 wrote to memory of 2636 2292 fxfxhn.exe 33 PID 2292 wrote to memory of 2636 2292 fxfxhn.exe 33 PID 2292 wrote to memory of 2636 2292 fxfxhn.exe 33 PID 2636 wrote to memory of 2740 2636 rhhdjd.exe 34 PID 2636 wrote to memory of 2740 2636 rhhdjd.exe 34 PID 2636 wrote to memory of 2740 2636 rhhdjd.exe 34 PID 2636 wrote to memory of 2740 2636 rhhdjd.exe 34 PID 2740 wrote to memory of 2532 2740 vdjnpb.exe 35 PID 2740 wrote to memory of 2532 2740 vdjnpb.exe 35 PID 2740 wrote to memory of 2532 2740 vdjnpb.exe 35 PID 2740 wrote to memory of 2532 2740 vdjnpb.exe 35 PID 2532 wrote to memory of 2376 2532 rhjprb.exe 36 PID 2532 wrote to memory of 2376 2532 rhjprb.exe 36 PID 2532 wrote to memory of 2376 2532 rhjprb.exe 36 PID 2532 wrote to memory of 2376 2532 rhjprb.exe 36 PID 2376 wrote to memory of 2868 2376 jdvdl.exe 37 PID 2376 wrote to memory of 2868 2376 jdvdl.exe 37 PID 2376 wrote to memory of 2868 2376 jdvdl.exe 37 PID 2376 wrote to memory of 2868 2376 jdvdl.exe 37 PID 2868 wrote to memory of 1652 2868 pxhrvt.exe 38 PID 2868 wrote to memory of 1652 2868 pxhrvt.exe 38 PID 2868 wrote to memory of 1652 2868 pxhrvt.exe 38 PID 2868 wrote to memory of 1652 2868 pxhrvt.exe 38 PID 1652 wrote to memory of 1396 1652 fjddrxr.exe 39 PID 1652 wrote to memory of 1396 1652 fjddrxr.exe 39 PID 1652 wrote to memory of 1396 1652 fjddrxr.exe 39 PID 1652 wrote to memory of 1396 1652 fjddrxr.exe 39 PID 1396 wrote to memory of 1188 1396 lnbbr.exe 40 PID 1396 wrote to memory of 1188 1396 lnbbr.exe 40 PID 1396 wrote to memory of 1188 1396 lnbbr.exe 40 PID 1396 wrote to memory of 1188 1396 lnbbr.exe 40 PID 1188 wrote to memory of 1916 1188 tbvtxp.exe 41 PID 1188 wrote to memory of 1916 1188 tbvtxp.exe 41 PID 1188 wrote to memory of 1916 1188 tbvtxp.exe 41 PID 1188 wrote to memory of 1916 1188 tbvtxp.exe 41 PID 1916 wrote to memory of 2588 1916 prhrt.exe 42 PID 1916 wrote to memory of 2588 1916 prhrt.exe 42 PID 1916 wrote to memory of 2588 1916 prhrt.exe 42 PID 1916 wrote to memory of 2588 1916 prhrt.exe 42 PID 2588 wrote to memory of 2540 2588 vtfbrpf.exe 43 PID 2588 wrote to memory of 2540 2588 vtfbrpf.exe 43 PID 2588 wrote to memory of 2540 2588 vtfbrpf.exe 43 PID 2588 wrote to memory of 2540 2588 vtfbrpf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hvlbb.exec:\hvlbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\nbjxfpb.exec:\nbjxfpb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xrtxp.exec:\xrtxp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nthjlr.exec:\nthjlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fxfxhn.exec:\fxfxhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rhhdjd.exec:\rhhdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vdjnpb.exec:\vdjnpb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rhjprb.exec:\rhjprb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jdvdl.exec:\jdvdl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\pxhrvt.exec:\pxhrvt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\fjddrxr.exec:\fjddrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\lnbbr.exec:\lnbbr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\tbvtxp.exec:\tbvtxp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\prhrt.exec:\prhrt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vtfbrpf.exec:\vtfbrpf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tdjhp.exec:\tdjhp.exe17⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bvbfx.exec:\bvbfx.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bbhdf.exec:\bbhdf.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nrdtb.exec:\nrdtb.exe20⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lpxprtb.exec:\lpxprtb.exe21⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pvxxx.exec:\pvxxx.exe22⤵
- Executes dropped EXE
PID:1128 -
\??\c:\bhxhhbd.exec:\bhxhhbd.exe23⤵
- Executes dropped EXE
PID:2352 -
\??\c:\trrprdn.exec:\trrprdn.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bvjthdb.exec:\bvjthdb.exe25⤵
- Executes dropped EXE
PID:800 -
\??\c:\lfhpxn.exec:\lfhpxn.exe26⤵
- Executes dropped EXE
PID:324 -
\??\c:\hjpjxrp.exec:\hjpjxrp.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrjlt.exec:\lrjlt.exe28⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nrphvb.exec:\nrphvb.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pppddp.exec:\pppddp.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pblxfxh.exec:\pblxfxh.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bdhxp.exec:\bdhxp.exe32⤵
- Executes dropped EXE
PID:632 -
\??\c:\fhdntp.exec:\fhdntp.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fvnfv.exec:\fvnfv.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xndlhr.exec:\xndlhr.exe35⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nlvth.exec:\nlvth.exe36⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vrtlrl.exec:\vrtlrl.exe37⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hrbbtr.exec:\hrbbtr.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bnblb.exec:\bnblb.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\thbnd.exec:\thbnd.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tjlfd.exec:\tjlfd.exe41⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tvfnr.exec:\tvfnr.exe42⤵
- Executes dropped EXE
PID:1728 -
\??\c:\brxhd.exec:\brxhd.exe43⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pfvbt.exec:\pfvbt.exe44⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hvvrd.exec:\hvvrd.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rbhnnb.exec:\rbhnnb.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dptnrrn.exec:\dptnrrn.exe47⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdvjxpl.exec:\jdvjxpl.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nltlh.exec:\nltlh.exe49⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bblbnr.exec:\bblbnr.exe50⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lvrftlt.exec:\lvrftlt.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ddnbdf.exec:\ddnbdf.exe52⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hnhlhl.exec:\hnhlhl.exe53⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dnjprlp.exec:\dnjprlp.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xbrfjhv.exec:\xbrfjhv.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ddnlj.exec:\ddnlj.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\plnvhxh.exec:\plnvhxh.exe57⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ptxbphn.exec:\ptxbphn.exe58⤵
- Executes dropped EXE
PID:548 -
\??\c:\vpbjd.exec:\vpbjd.exe59⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jxrttl.exec:\jxrttl.exe60⤵
- Executes dropped EXE
PID:884 -
\??\c:\hnllf.exec:\hnllf.exe61⤵
- Executes dropped EXE
PID:880 -
\??\c:\hjfjxrd.exec:\hjfjxrd.exe62⤵
- Executes dropped EXE
PID:1200 -
\??\c:\pbdflx.exec:\pbdflx.exe63⤵
- Executes dropped EXE
PID:2584 -
\??\c:\frttx.exec:\frttx.exe64⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hrhhxhn.exec:\hrhhxhn.exe65⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dtpblt.exec:\dtpblt.exe66⤵PID:2744
-
\??\c:\hrrnp.exec:\hrrnp.exe67⤵PID:1912
-
\??\c:\xpfhbpx.exec:\xpfhbpx.exe68⤵PID:1436
-
\??\c:\pvpbfbh.exec:\pvpbfbh.exe69⤵PID:1504
-
\??\c:\jttbnrj.exec:\jttbnrj.exe70⤵PID:2164
-
\??\c:\xxvrf.exec:\xxvrf.exe71⤵PID:2432
-
\??\c:\rvjbdfl.exec:\rvjbdfl.exe72⤵PID:1440
-
\??\c:\xvdtjx.exec:\xvdtjx.exe73⤵PID:1784
-
\??\c:\bffhl.exec:\bffhl.exe74⤵PID:2852
-
\??\c:\rpnvrvn.exec:\rpnvrvn.exe75⤵PID:940
-
\??\c:\jjrxhj.exec:\jjrxhj.exe76⤵PID:1532
-
\??\c:\tvxhvt.exec:\tvxhvt.exe77⤵PID:844
-
\??\c:\lndfhp.exec:\lndfhp.exe78⤵PID:2312
-
\??\c:\tvvxp.exec:\tvvxp.exe79⤵PID:2992
-
\??\c:\pvjllr.exec:\pvjllr.exe80⤵PID:2812
-
\??\c:\vbpjdxp.exec:\vbpjdxp.exe81⤵PID:2280
-
\??\c:\rvfxf.exec:\rvfxf.exe82⤵PID:1096
-
\??\c:\pbftnnp.exec:\pbftnnp.exe83⤵PID:1712
-
\??\c:\vlxfjxb.exec:\vlxfjxb.exe84⤵PID:2196
-
\??\c:\jvnrjj.exec:\jvnrjj.exe85⤵PID:1808
-
\??\c:\hlrvb.exec:\hlrvb.exe86⤵PID:1552
-
\??\c:\nnlxfp.exec:\nnlxfp.exe87⤵PID:1480
-
\??\c:\tjfrhnl.exec:\tjfrhnl.exe88⤵PID:1672
-
\??\c:\rhtvtxb.exec:\rhtvtxb.exe89⤵PID:2080
-
\??\c:\xvntj.exec:\xvntj.exe90⤵PID:2932
-
\??\c:\dfvvrl.exec:\dfvvrl.exe91⤵PID:2140
-
\??\c:\trvxpl.exec:\trvxpl.exe92⤵PID:1676
-
\??\c:\hvbrhx.exec:\hvbrhx.exe93⤵PID:1564
-
\??\c:\bpvhfdx.exec:\bpvhfdx.exe94⤵PID:1792
-
\??\c:\xnntn.exec:\xnntn.exe95⤵PID:2176
-
\??\c:\dpxbx.exec:\dpxbx.exe96⤵PID:2892
-
\??\c:\thbhj.exec:\thbhj.exe97⤵PID:1744
-
\??\c:\fdvjx.exec:\fdvjx.exe98⤵PID:3020
-
\??\c:\bnjbnb.exec:\bnjbnb.exe99⤵PID:2508
-
\??\c:\jndnx.exec:\jndnx.exe100⤵PID:2996
-
\??\c:\njdpppn.exec:\njdpppn.exe101⤵PID:2672
-
\??\c:\dnnvhj.exec:\dnnvhj.exe102⤵PID:2632
-
\??\c:\lxhppx.exec:\lxhppx.exe103⤵PID:2648
-
\??\c:\rvnfj.exec:\rvnfj.exe104⤵PID:2416
-
\??\c:\bpjhr.exec:\bpjhr.exe105⤵PID:2740
-
\??\c:\pfdhrhb.exec:\pfdhrhb.exe106⤵PID:2660
-
\??\c:\xtdhdh.exec:\xtdhdh.exe107⤵PID:2440
-
\??\c:\hfnpxl.exec:\hfnpxl.exe108⤵PID:2044
-
\??\c:\rnprbx.exec:\rnprbx.exe109⤵PID:3040
-
\??\c:\hpbllxt.exec:\hpbllxt.exe110⤵PID:240
-
\??\c:\jftpd.exec:\jftpd.exe111⤵PID:2984
-
\??\c:\trdfr.exec:\trdfr.exe112⤵PID:1364
-
\??\c:\rvfhpj.exec:\rvfhpj.exe113⤵PID:1928
-
\??\c:\xjjtt.exec:\xjjtt.exe114⤵PID:1372
-
\??\c:\pxblhtd.exec:\pxblhtd.exe115⤵PID:280
-
\??\c:\nbbbrr.exec:\nbbbrr.exe116⤵PID:2696
-
\??\c:\pdhtvv.exec:\pdhtvv.exe117⤵PID:2752
-
\??\c:\jhhprb.exec:\jhhprb.exe118⤵PID:2332
-
\??\c:\bxvhp.exec:\bxvhp.exe119⤵PID:2040
-
\??\c:\nhxlxdb.exec:\nhxlxdb.exe120⤵PID:1104
-
\??\c:\lpxtv.exec:\lpxtv.exe121⤵PID:1980
-
\??\c:\xtffj.exec:\xtffj.exe122⤵PID:1976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-