Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe
-
Size
68KB
-
MD5
3ee00d9c5ddeaf30851b1c6099f5deaa
-
SHA1
c6049f6c5f144babe97e865b1d8e6a41dd77ebd6
-
SHA256
42999644d7fc5dec2634f3623f972e0cbb48bc83e4a4a88436e268df33ef8ef1
-
SHA512
8675ed650a54dd507f8bb485fed85ca2c8ba8fd32a162cf43da74a39d89fd90f7cbaed1bf328340e7798aceaa243d0d831a662a9b9dcf8d23b4eb48bfdb966fd
-
SSDEEP
768:XU/ZgiRAiSxQAcdkbehvh8UjuvkII9l60HRyhY32bAtQtFMHBQAhIkl8Y:muiyxjnA8guvW9fZ2beSdY
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2556 3ee00d9c5ddeaf30851b1c6099f5deaa_JaffaCakes118.exe