Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 04:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe
-
Size
31KB
-
MD5
5a7f88cdc3cbda9c35a405ee758c8880
-
SHA1
68c4866adb561053ec7168c9f10df242d035720f
-
SHA256
7c0d849d645d0dc901359676aac535a3dcba86e6cbf7927af1537da921e5013b
-
SHA512
cd5be64666eb32bea0257fd23f79742ec1ba7a53cda5dc0a4f8d1d141d3c2565023c2723a6055aaa9d52ca7e45d9071a8dec474cf38bd0772a82708b80b26d11
-
SSDEEP
768:ZfIPfXOhlKoLxtCt74y/842kGim5admgS0CX0MP:WCKoLD+h/84UimkdxMP
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3444 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 56 PID 4372 wrote to memory of 3444 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 56 PID 4372 wrote to memory of 3444 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 56 PID 4372 wrote to memory of 3444 4372 5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a7f88cdc3cbda9c35a405ee758c8880_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372
-