Analysis
- max time kernel
80s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
- Target a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe
- Size 2.1MB
- Sample240613-vennpaxblc
- SHA256 57f1d96e27f69f5224c4dca04c210eaf6c35bf180d9546f5a1fa28f2a79cf2c7
- MD5 a69a1edcc3be6f630540e4eff631238c
- SHA1 c67df7238195db02e401ed11c6bf9ef6d802997a
- SHA512 9d412167d765fc676b37f4b9e2fe7dd22b932a18b2ae834dbaaa0cdd6c2720846704365475f45af189f8eb5f64519ca7aa7a56c329694b82347ba35d6059dfd7
- SSDEEP 49152:j1kgd3O6rCjH3fMSLMACmxYxTtL4fd7nS7qm7w+CPkU0zp+HxGHJO3vb7yFX/:zd3OzfMS4ACmPS
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe 2984 a69a1edcc3be6f630540e4eff631238c_JaffaCakes118.exe