Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:11
Static task
static1
Behavioral task
behavioral1
Sample
3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
3665af3ad5fed9a66f8ea364fbd8720c
-
SHA1
8fad6d709b0da6f86896d0f85fa69888b5b36e6d
-
SHA256
3e7d94766e1d19a041943deb396881a1b5015fce257d61f3350d095c2ec07136
-
SHA512
eaf2b560b9c1c65952c80ac0bbc6b377b2ca370b5b0641b914c00967d229b2507543ba6613d5963e4e3b6b0b5047d71f6967e631ae7b7ce0fd05db8b2af3b627
-
SSDEEP
3072:Yjd5WXpYI+538b8Hpd3cN+UQTvK96iCAn+hQn2T1thg9i4sHNKgRDSaRRn4Boi6J:H2DSabMoi6YimyDXJbDx3iYUT+hnHd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2284-4-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2284-7-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2284-6-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2284-8-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2284-19-0x0000000000400000-0x0000000000472000-memory.dmp upx -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exedescription pid process target process PID 2476 set thread context of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 set thread context of 0 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 set thread context of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exepid process 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exedescription pid process target process PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 2284 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 0 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 0 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 0 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 0 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2476 wrote to memory of 0 2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe PID 2284 wrote to memory of 2820 2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"3⤵PID:2820