Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 13:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe
-
Size
36KB
-
MD5
394834d425564ae3f12913aa393d4a67
-
SHA1
f1e52bd8f9c44272ac5186f40d11463e322acd22
-
SHA256
f2ab6cfd4abf2a79446e976183787dd03ef8b97cb7c0b101b4ee275cce780b4d
-
SHA512
d849417371001e743f157856dfae7b6715966a8e19c17c58736d5cf415a24c210a48def5055642c4cfeb59807c9ccd95b221633b1efb319e6ea924e73b6575f0
-
SSDEEP
384:tBbK+6F6RJQQNl7TIVAYEu2famlMLTy/rzSyUTEglp9OLnlFR2F4t5n+IsxQRj/9:yZKl7T3u2S2Wmglp9K3C+5BrUW
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2704 set thread context of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2704 wrote to memory of 2780 2704 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 31 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21 PID 2780 wrote to memory of 1164 2780 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780
-
-