Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 05:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe
-
Size
168KB
-
MD5
4491146414a5ebd65733fab42a62e115
-
SHA1
99daa9f1432254c242ff8cf5ba6cb2c3dc330427
-
SHA256
e452797adaffb04899a30d8fc78375aef47a9e598b9e616228fc1cd36d39a455
-
SHA512
86e01c1efe30eb21d31fd45ff1407ca9d3cddc5d82fde317a0d4ec15c84d716c3380deefa21ac2dda6d9638a710465178b5cafa5321e402331850da18758e144
-
SSDEEP
3072:e0pS3JU2PwzzHiwHge7Vu2qr6ydO+iY23IrwwdEwVaKFr1D1LpF7KbA4djJ/E6Q:evzE6oVw6yaYUwuelJLT7H4dNE6Q
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3580 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 56 PID 5048 wrote to memory of 3580 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 56 PID 5048 wrote to memory of 3580 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 56 PID 5048 wrote to memory of 3580 5048 4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4491146414a5ebd65733fab42a62e115_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5048
-