Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 03:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
b69e6e54bfcc2536be519d9cdc691b03
-
SHA1
3797a5718c3e7a123eb9005e8e137229b5eadb67
-
SHA256
deccbaea4951de166f83748b3ed4bd5d06b49bfe53f7106694f15c7c3102f548
-
SHA512
3cdc68e0fccdc168b70d3a380b8706bfe2362299a045bf70ae34c87f77578c503ef02ecb53895d363e2ee1dfdfc4f2645f54b7193c83374d2a77c241f03f5e77
-
SSDEEP
24576:+u6J33O0c+JY5UZ+XC0kGso6FaAr5eee7o2iE7zQqWY:Qu0c++OCvkGs9FaA1AvzoY
Score
1/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exepid process 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exepid process 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exedescription pid process target process PID 1924 wrote to memory of 1996 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 1996 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 1996 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 1996 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2548 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2548 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2548 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2548 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2132 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2132 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2132 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2132 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2916 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2916 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2916 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2916 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2656 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2656 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2656 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2656 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2936 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2936 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2936 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe PID 1924 wrote to memory of 2936 1924 b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b69e6e54bfcc2536be519d9cdc691b03_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1924-0-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB