Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 20:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
16 signatures
150 seconds
General
-
Target
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe
-
Size
167KB
-
MD5
0f70ec21027ad7bbcb46861cde32216f
-
SHA1
69512ffddf7230ec3d2bcfc9c02ef8b4fb6d10c4
-
SHA256
00793e7325854f44f54f80b285d52d525e40f96b3d71eb325163c6ef523e0eda
-
SHA512
f08f2b8a63f8482962698058663d2a21e71186f6ff213d5736949c5804a7f722970920dc9f70dc112a2c8611db00e172aca38455c64f213bc231814f8039e78c
-
SSDEEP
3072:JN6KBVsqIVJltZrpRZN3BrWi08Dy/oBjQ7KFTEAkT+:JNhsx1thpqi/DyARG3v+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2040 1620 WerFault.exe 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exedescription pid process target process PID 1620 wrote to memory of 2040 1620 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe WerFault.exe PID 1620 wrote to memory of 2040 1620 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe WerFault.exe PID 1620 wrote to memory of 2040 1620 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe WerFault.exe PID 1620 wrote to memory of 2040 1620 0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f70ec21027ad7bbcb46861cde32216f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1602⤵
- Program crash
PID:2040
-