Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe
-
Size
103KB
-
MD5
0ed7d6b95d7cd191c0ebb581ee8a7e8c
-
SHA1
f808d0d3f80dd15232723aabae01ab022d59281d
-
SHA256
1b9fd13c6b0b0b53b5893bf89e3160e7d40e157547a0c0ea03ff1c84e0b9d5a2
-
SHA512
03fd2b6d8c0714e5d63791b98a2a8b91334441adad3addd9e97113bfdb1c93e062b5e9e7ad89bca2d0dfbc4a764de2346b7e702c45401ece1e57dad41751e1eb
-
SSDEEP
1536:d9KS9mAjWtODFCbDlcctMGxjPpseD1EaUySz8CWS4MIw3i6Oq+UMNoQjv:d1hjWIxuJxjPpvDP6BLJjMNoQj
Score
1/10
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 5112 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5112 wrote to memory of 3772 5112 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe 82 PID 5112 wrote to memory of 3772 5112 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe 82 PID 5112 wrote to memory of 3772 5112 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe 82 PID 5112 wrote to memory of 3772 5112 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe 82 PID 5112 wrote to memory of 3772 5112 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:3772
-