Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 11:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe
-
Size
39KB
-
MD5
45f139e8bbb689b188d17e55d0dca22f
-
SHA1
322af0a74e4d750170a4aca067446df69d186a78
-
SHA256
984328a414d599a273176939ab8022dcbab814b929dc9d9ff1b77d939014d652
-
SHA512
44ae713b1803251bc8bb7965e0785301bbd76b80b5b65f0b8e9df16bf0f1c2ea07efe1c51a10a33d8647ab0c1d6854d44e268cf7b8292806cb9414b60bf1c96b
-
SSDEEP
768:KOxZOgIryM1P3oO2y8UN2ivcTTJlu71TFA9nn0OjDDdmo/SK2OURvXZX38mZUaFy:nSgy19JSVO1ONn511/tivXZnVGas
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4680 hhtnhh.exe 3752 ntbbnn.exe 1428 lxfxllr.exe 2124 ddjjp.exe 3100 rffxlff.exe 2588 ddvpp.exe 3528 lrxfrrr.exe 4516 1rxrffl.exe 4152 hhnntt.exe 3548 ppvvj.exe 1968 xrfllfl.exe 2892 7flxrrr.exe 3260 hnttnh.exe 4296 jdvjv.exe 3872 9rffxxr.exe 216 hhbtnn.exe 3916 ddjdd.exe 3888 ffxrrlx.exe 4428 bnbtbb.exe 1520 bhnhtn.exe 4444 5llxllx.exe 1412 7nnttb.exe 4380 ddpjj.exe 4904 fxxrxxx.exe 1576 vpvpj.exe 4628 rllrrrr.exe 3520 thbttt.exe 1688 lfrlllr.exe 3064 7xrlllf.exe 4332 nntnhb.exe 4164 3pdvp.exe 1700 dvdvp.exe 2856 xflxllf.exe 4312 hnttnh.exe 1800 bbthbh.exe 4988 jddvp.exe 1808 9pppd.exe 4632 fxrlxrl.exe 2160 hntnhh.exe 4976 1dpdd.exe 1048 xlfxlfx.exe 940 xffxrlf.exe 1152 nhhhnh.exe 996 3hnhtb.exe 3692 5ppjp.exe 5040 djjdp.exe 3708 rllfxxr.exe 1932 5lfxrlf.exe 3328 bhtnhh.exe 2348 nhnnhb.exe 3544 dvvpp.exe 4916 pppjv.exe 4492 fllfrrl.exe 4944 5bnhhh.exe 1344 htnbtt.exe 4372 5pdvv.exe 436 rxxlxxr.exe 4128 7lfxrrl.exe 4296 bttnhh.exe 4604 dpdvp.exe 2308 5fffrfx.exe 528 fllllfx.exe 4668 hnnnhh.exe 4636 jvdvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 4680 4368 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 82 PID 4368 wrote to memory of 4680 4368 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 82 PID 4368 wrote to memory of 4680 4368 45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe 82 PID 4680 wrote to memory of 3752 4680 hhtnhh.exe 85 PID 4680 wrote to memory of 3752 4680 hhtnhh.exe 85 PID 4680 wrote to memory of 3752 4680 hhtnhh.exe 85 PID 3752 wrote to memory of 1428 3752 ntbbnn.exe 87 PID 3752 wrote to memory of 1428 3752 ntbbnn.exe 87 PID 3752 wrote to memory of 1428 3752 ntbbnn.exe 87 PID 1428 wrote to memory of 2124 1428 lxfxllr.exe 88 PID 1428 wrote to memory of 2124 1428 lxfxllr.exe 88 PID 1428 wrote to memory of 2124 1428 lxfxllr.exe 88 PID 2124 wrote to memory of 3100 2124 ddjjp.exe 89 PID 2124 wrote to memory of 3100 2124 ddjjp.exe 89 PID 2124 wrote to memory of 3100 2124 ddjjp.exe 89 PID 3100 wrote to memory of 2588 3100 rffxlff.exe 90 PID 3100 wrote to memory of 2588 3100 rffxlff.exe 90 PID 3100 wrote to memory of 2588 3100 rffxlff.exe 90 PID 2588 wrote to memory of 3528 2588 ddvpp.exe 91 PID 2588 wrote to memory of 3528 2588 ddvpp.exe 91 PID 2588 wrote to memory of 3528 2588 ddvpp.exe 91 PID 3528 wrote to memory of 4516 3528 lrxfrrr.exe 92 PID 3528 wrote to memory of 4516 3528 lrxfrrr.exe 92 PID 3528 wrote to memory of 4516 3528 lrxfrrr.exe 92 PID 4516 wrote to memory of 4152 4516 1rxrffl.exe 93 PID 4516 wrote to memory of 4152 4516 1rxrffl.exe 93 PID 4516 wrote to memory of 4152 4516 1rxrffl.exe 93 PID 4152 wrote to memory of 3548 4152 hhnntt.exe 94 PID 4152 wrote to memory of 3548 4152 hhnntt.exe 94 PID 4152 wrote to memory of 3548 4152 hhnntt.exe 94 PID 3548 wrote to memory of 1968 3548 ppvvj.exe 95 PID 3548 wrote to memory of 1968 3548 ppvvj.exe 95 PID 3548 wrote to memory of 1968 3548 ppvvj.exe 95 PID 1968 wrote to memory of 2892 1968 xrfllfl.exe 96 PID 1968 wrote to memory of 2892 1968 xrfllfl.exe 96 PID 1968 wrote to memory of 2892 1968 xrfllfl.exe 96 PID 2892 wrote to memory of 3260 2892 7flxrrr.exe 97 PID 2892 wrote to memory of 3260 2892 7flxrrr.exe 97 PID 2892 wrote to memory of 3260 2892 7flxrrr.exe 97 PID 3260 wrote to memory of 4296 3260 hnttnh.exe 98 PID 3260 wrote to memory of 4296 3260 hnttnh.exe 98 PID 3260 wrote to memory of 4296 3260 hnttnh.exe 98 PID 4296 wrote to memory of 3872 4296 jdvjv.exe 99 PID 4296 wrote to memory of 3872 4296 jdvjv.exe 99 PID 4296 wrote to memory of 3872 4296 jdvjv.exe 99 PID 3872 wrote to memory of 216 3872 9rffxxr.exe 100 PID 3872 wrote to memory of 216 3872 9rffxxr.exe 100 PID 3872 wrote to memory of 216 3872 9rffxxr.exe 100 PID 216 wrote to memory of 3916 216 hhbtnn.exe 101 PID 216 wrote to memory of 3916 216 hhbtnn.exe 101 PID 216 wrote to memory of 3916 216 hhbtnn.exe 101 PID 3916 wrote to memory of 3888 3916 ddjdd.exe 102 PID 3916 wrote to memory of 3888 3916 ddjdd.exe 102 PID 3916 wrote to memory of 3888 3916 ddjdd.exe 102 PID 3888 wrote to memory of 4428 3888 ffxrrlx.exe 103 PID 3888 wrote to memory of 4428 3888 ffxrrlx.exe 103 PID 3888 wrote to memory of 4428 3888 ffxrrlx.exe 103 PID 4428 wrote to memory of 1520 4428 bnbtbb.exe 104 PID 4428 wrote to memory of 1520 4428 bnbtbb.exe 104 PID 4428 wrote to memory of 1520 4428 bnbtbb.exe 104 PID 1520 wrote to memory of 4444 1520 bhnhtn.exe 106 PID 1520 wrote to memory of 4444 1520 bhnhtn.exe 106 PID 1520 wrote to memory of 4444 1520 bhnhtn.exe 106 PID 4444 wrote to memory of 1412 4444 5llxllx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45f139e8bbb689b188d17e55d0dca22f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\hhtnhh.exec:\hhtnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\ntbbnn.exec:\ntbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\lxfxllr.exec:\lxfxllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\ddjjp.exec:\ddjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\rffxlff.exec:\rffxlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\ddvpp.exec:\ddvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lrxfrrr.exec:\lrxfrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\1rxrffl.exec:\1rxrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\hhnntt.exec:\hhnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\ppvvj.exec:\ppvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\xrfllfl.exec:\xrfllfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7flxrrr.exec:\7flxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hnttnh.exec:\hnttnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\jdvjv.exec:\jdvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\9rffxxr.exec:\9rffxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\hhbtnn.exec:\hhbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\ddjdd.exec:\ddjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\ffxrrlx.exec:\ffxrrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\bnbtbb.exec:\bnbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\bhnhtn.exec:\bhnhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\5llxllx.exec:\5llxllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\7nnttb.exec:\7nnttb.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ddpjj.exec:\ddpjj.exe24⤵
- Executes dropped EXE
PID:4380 -
\??\c:\fxxrxxx.exec:\fxxrxxx.exe25⤵
- Executes dropped EXE
PID:4904 -
\??\c:\vpvpj.exec:\vpvpj.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rllrrrr.exec:\rllrrrr.exe27⤵
- Executes dropped EXE
PID:4628 -
\??\c:\thbttt.exec:\thbttt.exe28⤵
- Executes dropped EXE
PID:3520 -
\??\c:\lfrlllr.exec:\lfrlllr.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7xrlllf.exec:\7xrlllf.exe30⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nntnhb.exec:\nntnhb.exe31⤵
- Executes dropped EXE
PID:4332 -
\??\c:\3pdvp.exec:\3pdvp.exe32⤵
- Executes dropped EXE
PID:4164 -
\??\c:\dvdvp.exec:\dvdvp.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xflxllf.exec:\xflxllf.exe34⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hnttnh.exec:\hnttnh.exe35⤵
- Executes dropped EXE
PID:4312 -
\??\c:\bbthbh.exec:\bbthbh.exe36⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jddvp.exec:\jddvp.exe37⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9pppd.exec:\9pppd.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe39⤵
- Executes dropped EXE
PID:4632 -
\??\c:\hntnhh.exec:\hntnhh.exe40⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1dpdd.exec:\1dpdd.exe41⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe42⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xffxrlf.exec:\xffxrlf.exe43⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhhhnh.exec:\nhhhnh.exe44⤵
- Executes dropped EXE
PID:1152 -
\??\c:\3hnhtb.exec:\3hnhtb.exe45⤵
- Executes dropped EXE
PID:996 -
\??\c:\5ppjp.exec:\5ppjp.exe46⤵
- Executes dropped EXE
PID:3692 -
\??\c:\djjdp.exec:\djjdp.exe47⤵
- Executes dropped EXE
PID:5040 -
\??\c:\rllfxxr.exec:\rllfxxr.exe48⤵
- Executes dropped EXE
PID:3708 -
\??\c:\5lfxrlf.exec:\5lfxrlf.exe49⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bhtnhh.exec:\bhtnhh.exe50⤵
- Executes dropped EXE
PID:3328 -
\??\c:\nhnnhb.exec:\nhnnhb.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dvvpp.exec:\dvvpp.exe52⤵
- Executes dropped EXE
PID:3544 -
\??\c:\pppjv.exec:\pppjv.exe53⤵
- Executes dropped EXE
PID:4916 -
\??\c:\fllfrrl.exec:\fllfrrl.exe54⤵
- Executes dropped EXE
PID:4492 -
\??\c:\5bnhhh.exec:\5bnhhh.exe55⤵
- Executes dropped EXE
PID:4944 -
\??\c:\htnbtt.exec:\htnbtt.exe56⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5pdvv.exec:\5pdvv.exe57⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe58⤵
- Executes dropped EXE
PID:436 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe59⤵
- Executes dropped EXE
PID:4128 -
\??\c:\bttnhh.exec:\bttnhh.exe60⤵
- Executes dropped EXE
PID:4296 -
\??\c:\dpdvp.exec:\dpdvp.exe61⤵
- Executes dropped EXE
PID:4604 -
\??\c:\5fffrfx.exec:\5fffrfx.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\fllllfx.exec:\fllllfx.exe63⤵
- Executes dropped EXE
PID:528 -
\??\c:\hnnnhh.exec:\hnnnhh.exe64⤵
- Executes dropped EXE
PID:4668 -
\??\c:\jvdvp.exec:\jvdvp.exe65⤵
- Executes dropped EXE
PID:4636 -
\??\c:\9xrlxxr.exec:\9xrlxxr.exe66⤵PID:4324
-
\??\c:\5bbbtt.exec:\5bbbtt.exe67⤵PID:1972
-
\??\c:\nhtnnn.exec:\nhtnnn.exe68⤵PID:4840
-
\??\c:\vpppj.exec:\vpppj.exe69⤵PID:4768
-
\??\c:\dpvjv.exec:\dpvjv.exe70⤵PID:2464
-
\??\c:\5rrlfll.exec:\5rrlfll.exe71⤵PID:1616
-
\??\c:\llrffll.exec:\llrffll.exe72⤵PID:3792
-
\??\c:\bbtbbb.exec:\bbtbbb.exe73⤵PID:4088
-
\??\c:\5vvjv.exec:\5vvjv.exe74⤵PID:2448
-
\??\c:\5ffrllf.exec:\5ffrllf.exe75⤵PID:2736
-
\??\c:\1xxrfrf.exec:\1xxrfrf.exe76⤵PID:4008
-
\??\c:\hbttnn.exec:\hbttnn.exe77⤵PID:4064
-
\??\c:\pjddv.exec:\pjddv.exe78⤵PID:1780
-
\??\c:\lffxlfr.exec:\lffxlfr.exe79⤵PID:4380
-
\??\c:\rxllfrl.exec:\rxllfrl.exe80⤵PID:4964
-
\??\c:\bhthbb.exec:\bhthbb.exe81⤵PID:3696
-
\??\c:\9htbnb.exec:\9htbnb.exe82⤵PID:4132
-
\??\c:\7vvpj.exec:\7vvpj.exe83⤵PID:4628
-
\??\c:\jjddp.exec:\jjddp.exe84⤵PID:840
-
\??\c:\1rxrlfx.exec:\1rxrlfx.exe85⤵PID:1876
-
\??\c:\hhbtnn.exec:\hhbtnn.exe86⤵PID:3732
-
\??\c:\5bhnhh.exec:\5bhnhh.exe87⤵PID:8
-
\??\c:\pjjvj.exec:\pjjvj.exe88⤵PID:4424
-
\??\c:\3xxfxfr.exec:\3xxfxfr.exe89⤵PID:4584
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe90⤵PID:1688
-
\??\c:\hthbbb.exec:\hthbbb.exe91⤵PID:1004
-
\??\c:\jdddv.exec:\jdddv.exe92⤵PID:3492
-
\??\c:\5rxrlll.exec:\5rxrlll.exe93⤵PID:2544
-
\??\c:\7bbtbh.exec:\7bbtbh.exe94⤵PID:3780
-
\??\c:\hhhbnh.exec:\hhhbnh.exe95⤵PID:4240
-
\??\c:\1djdj.exec:\1djdj.exe96⤵PID:4352
-
\??\c:\xflrlff.exec:\xflrlff.exe97⤵PID:2916
-
\??\c:\thnhtt.exec:\thnhtt.exe98⤵PID:3940
-
\??\c:\nnbtbb.exec:\nnbtbb.exe99⤵PID:4988
-
\??\c:\9jjdp.exec:\9jjdp.exe100⤵PID:3980
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe101⤵PID:832
-
\??\c:\9rfxxxr.exec:\9rfxxxr.exe102⤵PID:1772
-
\??\c:\bthhnn.exec:\bthhnn.exe103⤵PID:1204
-
\??\c:\vvpjj.exec:\vvpjj.exe104⤵PID:4364
-
\??\c:\ddjdd.exec:\ddjdd.exe105⤵PID:4592
-
\??\c:\5rrrllr.exec:\5rrrllr.exe106⤵PID:1956
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe107⤵PID:2124
-
\??\c:\tnnnhh.exec:\tnnnhh.exe108⤵PID:4076
-
\??\c:\pvdvj.exec:\pvdvj.exe109⤵PID:1676
-
\??\c:\pvjdv.exec:\pvjdv.exe110⤵PID:4184
-
\??\c:\5rfllxf.exec:\5rfllxf.exe111⤵PID:3640
-
\??\c:\1ttnhh.exec:\1ttnhh.exe112⤵PID:4028
-
\??\c:\1hhhtt.exec:\1hhhtt.exe113⤵PID:4068
-
\??\c:\7ppjd.exec:\7ppjd.exe114⤵PID:3656
-
\??\c:\jjddp.exec:\jjddp.exe115⤵PID:776
-
\??\c:\7xlrrxr.exec:\7xlrrxr.exe116⤵PID:3544
-
\??\c:\3bnnhh.exec:\3bnnhh.exe117⤵PID:2724
-
\??\c:\dvvpj.exec:\dvvpj.exe118⤵PID:620
-
\??\c:\7pppp.exec:\7pppp.exe119⤵PID:4944
-
\??\c:\fxrlflr.exec:\fxrlflr.exe120⤵PID:1344
-
\??\c:\9hhbnh.exec:\9hhbnh.exe121⤵PID:4372
-
\??\c:\vppjd.exec:\vppjd.exe122⤵PID:4872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-