Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 08:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe
Resource
win7-20240705-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe
-
Size
149KB
-
MD5
628b33ab0f1d44f0a8acf43a3caa480c
-
SHA1
93ffaa42ccf70ed89f5af845fa33472a98902363
-
SHA256
802f9cb81495e6215210158a4019f028d62a6c5fb5537f7bc4373874ae92e718
-
SHA512
c46fb082e70b1da225e6ffc4c97cf3573c841d19ee6ff35286bfe12ea2ef8983f3bd435d467ebd4f79f821d219f6b0d407ec5a9103b3c11d2455e51cfff60ad3
-
SSDEEP
3072:+x+kTh4DRXnEfrQ4UJ8EvtEWIaHWgNcKHH:ih6ETA8Wp5AG
Score
1/10
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1316 628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1316 wrote to memory of 1216 1316 628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe 21 PID 1316 wrote to memory of 1216 1316 628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\628b33ab0f1d44f0a8acf43a3caa480c_JaffaCakes118.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1316
-