Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe
-
Size
19KB
-
MD5
19d7aa9a9e5c5f5c3f8866d37a2a5b65
-
SHA1
d3c4fae076515bb05ee570a93c22db0b665dcadc
-
SHA256
4501669e450afd7e7b8336b97d85692821f3ad29829ceafee0e10f6a3846ba8d
-
SHA512
549f42ce82c8d0c258b99e548ed1bdd47957d679018657710449a422e9af93198bbec9cfdf518a9b1b1ba681a9ce19242a3699152c419f0bf90e3068cc6a6734
-
SSDEEP
384:bthFiYz4hQ4fCb73mdIqBi7vl9z9thHZVyaU:RT3VQI2ddBw9zftZnU
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56 PID 1820 wrote to memory of 3492 1820 19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19d7aa9a9e5c5f5c3f8866d37a2a5b65_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820
-