Analysis
-
max time kernel
94s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 13:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe
-
Size
36KB
-
MD5
394834d425564ae3f12913aa393d4a67
-
SHA1
f1e52bd8f9c44272ac5186f40d11463e322acd22
-
SHA256
f2ab6cfd4abf2a79446e976183787dd03ef8b97cb7c0b101b4ee275cce780b4d
-
SHA512
d849417371001e743f157856dfae7b6715966a8e19c17c58736d5cf415a24c210a48def5055642c4cfeb59807c9ccd95b221633b1efb319e6ea924e73b6575f0
-
SSDEEP
384:tBbK+6F6RJQQNl7TIVAYEu2famlMLTy/rzSyUTEglp9OLnlFR2F4t5n+IsxQRj/9:yZKl7T3u2S2Wmglp9K3C+5BrUW
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4260 set thread context of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 4260 wrote to memory of 3048 4260 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 88 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56 PID 3048 wrote to memory of 3544 3048 394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\394834d425564ae3f12913aa393d4a67_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3048
-
-