Analysis
-
max time kernel
95s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe
-
Size
31KB
-
MD5
5b844b1254328ef7b0c629206f4c9e55
-
SHA1
7b5322bfdea3e169250efa5ff6c4950ff32bae1d
-
SHA256
8fdbbd20066c78b1f0bceffc175a4aa145fb59275b89ebce76d4dbed17f5e143
-
SHA512
b16678c5abd99d72bcd596f24531a707ddde1b578f37306f9ea519d5f37ddc71adf9bc97591b11bb6ebfd6376390397131fa5e400536c68326e647570312d23e
-
SSDEEP
768:zIRfXOhlKoLxtCt74y/842kGim5admgS0CX0Mb:yCKoLD+h/84UimkdxMb
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 364 wrote to memory of 3332 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 56 PID 364 wrote to memory of 3332 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 56 PID 364 wrote to memory of 3332 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 56 PID 364 wrote to memory of 3332 364 5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b844b1254328ef7b0c629206f4c9e55_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:364
-