e899da463eab7373786ea94f3ba20f4cf5c31c8d12932d6bafb021216fa5a2e8 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 17:07

Sharing

Report Analysis Logs

General

Target

2325d720c36d304c913c3b9cde515fa2_JaffaCakes118.exe
Size

3KB
MD5

2325d720c36d304c913c3b9cde515fa2
SHA1

374006a22fdae34ea7eef0f0d87f4602e5924f9d
SHA256

e899da463eab7373786ea94f3ba20f4cf5c31c8d12932d6bafb021216fa5a2e8
SHA512

045a47c92a747dc8ff816bdb6e91eeba2cf13451fcdffcdf470e0e838d8e786e5ae7f3238a2772ded389d56e41b1a56f63887841e6a601655cdd793511de68f2

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	2325d720c36d304c913c3b9cde515fa2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1200	2428	2325d720c36d304c913c3b9cde515fa2_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\2325d720c36d304c913c3b9cde515fa2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2325d720c36d304c913c3b9cde515fa2_JaffaCakes118.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-0-0x0000000013140000-0x0000000013142000-memory.dmp

Filesize
8KB

Download
memory/2428-2-0x0000000013140000-0x0000000013142000-memory.dmp

Filesize
8KB

Download