Analysis
-
max time kernel
134s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe
-
Size
63KB
-
MD5
1898a628d5a66799afcb4ff51be55a22
-
SHA1
cf7535bb5bd013f585d233ddec6e6dfa40558e98
-
SHA256
783af99314ac45a3bade0e1ceda73e4d1d9176b6f44d53767ebeb2d45b4c1365
-
SHA512
ac0cf88e4e8f39e830bf7eb683c71ed95b79de78c7d9789c5a7f8e37b17bbf96fe8cce0476234b9b8080e52cd3bbecb31357bec4eba79131995fff91f25bb1f7
-
SSDEEP
1536:WGPrLmKW0jh9qvKqLrYUFrjjWo7+mYnk81:WeLmKZIvPYUFr3gku
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 220 wrote to memory of 3332 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 55 PID 220 wrote to memory of 3332 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 55 PID 220 wrote to memory of 3332 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 55 PID 220 wrote to memory of 3332 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 55 PID 220 wrote to memory of 3332 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 55 PID 220 wrote to memory of 3332 220 1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1898a628d5a66799afcb4ff51be55a22_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220
-