Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe
Resource
win7-20240220-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe
-
Size
147KB
-
MD5
255f8fa5eabc7dea262cfb7f6042199d
-
SHA1
ddc6f6e0fa52a67e0f9631225403f7e590e80c3f
-
SHA256
9a12ab2756bb9d70e039c5573d16a5ac117a5be7453cf02094cba8111cda1b86
-
SHA512
a2ac3ee41ede3066e804773f7fe5ddc0b8b925e24dee5372c1f6adc30975f6e3249aa4928235194468832c4102ab6fea80c52eab8b647853c2050a3459b5fe07
-
SSDEEP
3072:0lb9vaXaVTjb9A40FjjHyGla6k17YmG2a+aHg0FUmCj:07aXa9b9AHjz7la6k1EmGTJ
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 628 set thread context of 2368 628 255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 628 wrote to memory of 2368 628 255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe 82 PID 628 wrote to memory of 2368 628 255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe 82 PID 628 wrote to memory of 2368 628 255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\255f8fa5eabc7dea262cfb7f6042199d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\explorer.exe0000013C*2⤵PID:2368
-