Analysis
- max time kernel
51s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe
Resource
win7-20240611-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe
- Size 183KB
- Sample240612-hxtansteqm
- SHA256 f0ce400fbf8f417791c8c6a106eeb87cfb4248b513125fe8b74db14a883e511a
- MD5 9fd825feb05aa8903018b7b13d2e224c
- SHA1 e3eed234710c7f96fc84f6f7f469c0162702dcde
- SHA512 42d216e5a0cc4cdb52dc280432b0f8eb100e968e55a32a55ae47dbaa9fefae81f396e1f1fb6748bf3db78fd3eec7a9c3e8efdadf6c69d7be35d5676c4d19a46b
- SSDEEP 3072:JhoV0qoTpx1qfav+aimwai8HOXj10WnugCsmphWATwnoB3C:827+av+aYH8Hwu0mnonA
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of UnmapMainImage 1 IoCs
pid Process 3152 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4644 3152 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe 81 PID 3152 wrote to memory of 4644 3152 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe 81 PID 3152 wrote to memory of 4644 3152 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe 81 PID 3152 wrote to memory of 4644 3152 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe 81 PID 3152 wrote to memory of 4644 3152 9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9fd825feb05aa8903018b7b13d2e224c_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:4644
-