26765ed902db06f8c02348812a95806700d46b42a2147bf0ff6e43b0c0e109a5

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe
Size

522KB
MD5

0a598adc65b0cb318f7f4f6614a0f149
SHA1

ee642fb47dbce464c4f3831d78a1efcfab8a568e
SHA256

26765ed902db06f8c02348812a95806700d46b42a2147bf0ff6e43b0c0e109a5
SHA512

8f454a43319348109f12a1511fd0b71af3157e1f652e0ee3b2a26053cc0d6c8fad0983a9beb1fb90922cf251eaf66e4a88a2f3624de5912cb51f7273fe85330e
SSDEEP

12288:7rzRSHFeQ59Ve8dam/FsbvZv9fp6X6hxChRsMes4:f9CeM/Fd/FAZNpc6SHu

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1588	WerFault.exe	28

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28
PID 2208 wrote to memory of 1588	2208	0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a598adc65b0cb318f7f4f6614a0f149_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 284
    3⤵
    - Program crash
    PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-1-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-2-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-3-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-4-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-5-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-6-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-7-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-8-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-9-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-10-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-11-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-12-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-13-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-14-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-15-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-17-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-18-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-16-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-19-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-20-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-21-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-22-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-23-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-24-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-25-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-26-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-27-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-28-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-29-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-30-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-31-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-32-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-33-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-34-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-35-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-36-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-38-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-39-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-37-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-40-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-41-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-42-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-43-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-44-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-45-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-46-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-47-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-48-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-49-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-50-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-51-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-52-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-53-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-54-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-55-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-56-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-57-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-58-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-59-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-60-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-61-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-62-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-63-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-4476-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/1588-4479-0x0000000000F20000-0x0000000000F63000-memory.dmp

Filesize
268KB

Download
memory/2208-0-0x0000000000070000-0x00000000000AF000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads