Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 16:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bc9fea323ea31c5456b39ee766222c7_JaffaCakes118.dll
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bc9fea323ea31c5456b39ee766222c7_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1bc9fea323ea31c5456b39ee766222c7_JaffaCakes118.dll
-
Size
68KB
-
MD5
1bc9fea323ea31c5456b39ee766222c7
-
SHA1
cc585e8b63cc04da378c8a0fdf240c269791cc00
-
SHA256
7abd6f11c77c5564d066ad2210e879a398bf9fe49f17dbb3e1f125b5ea0705aa
-
SHA512
3967f09017406dae8e631e9959888d1959877d409c22da04c44ed9f59c4e7e33f2777ab34c88234e7dfd07957534566242df38dd6ee9eeb3ab68f1f871257e6e
-
SSDEEP
768:myZRo/DlmR8yfs1NfVt9pFxBZRFxBZphxG+WyKa6KCaG6mnH3BJJbr+0bhAUC5lr:A+1HxDr+OlVClJXt
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1152 4316 rundll32.exe 89 PID 4316 wrote to memory of 1152 4316 rundll32.exe 89 PID 4316 wrote to memory of 1152 4316 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bc9fea323ea31c5456b39ee766222c7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bc9fea323ea31c5456b39ee766222c7_JaffaCakes118.dll,#12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:81⤵PID:8