Overview

overview

3

Static

static

3

4b25b52563...18.exe

windows7-x64

1

4b25b52563...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 19:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe

  • Size

    248KB

  • MD5

    4b25b52563cdc1d4d87bd57d6a5bf3b7

  • SHA1

    532c0e1057862b3b71f4f690f857abed10e4705d

  • SHA256

    d98dda46300c142bdb16c4907efc6af434aa756ee938b5c7c67657ed649a2c0b

  • SHA512

    041403cead3a9187e0e0a8c8b49a2c5c9a1c47c327bc3702f04d9d340f6c1974f71fcd75c5764cb958e4cbfe6c52f70654998973096cd7e1de259eded1014fb6

  • SSDEEP

    3072:3MCWCfW5qZRW/lTgUQqj5Bl9rOY3GtrFXPUgDTVotdM:8PYqgUQqdHpOY328g/8M

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4416
          • C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
            C:\Users\Admin\AppData\Local\Temp\4b25b52563cdc1d4d87bd57d6a5bf3b7_JaffaCakes118.exe
            5⤵
              PID:2876

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads