Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 06:14
Behavioral task
behavioral1
Sample
3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe
-
Size
70KB
-
MD5
3c436ec247e04b853fc02924d9e4bd12
-
SHA1
0c505c78244a52082c750caa72da104e2dbeaa9b
-
SHA256
66d40a38caf22eb1a8b84e956d679dc977bc844b7e5195e0e75d74af40bffebb
-
SHA512
d0951e43c43ecaabbc158ed9ea9bc362958611b46bcd9a843f171a086d452bf3b7d1904a2736524f5aa68f606492e0bd1c6b8746b3d363a40d943214fe3ca5ec
-
SSDEEP
1536:S4tFE0rV6x0KEuvzmzeU7R5Ogjhn/ti1jW6SurfFDhsYXVO:S4tFfreX7geUJFti1jW6Sur9DOYXV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1104-0-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1104 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1104 wrote to memory of 64 1104 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 83 PID 1104 wrote to memory of 64 1104 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 83 PID 1104 wrote to memory of 64 1104 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 83 PID 1104 wrote to memory of 64 1104 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 83 PID 1104 wrote to memory of 64 1104 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:64
-