3c6f95d78d0b318086be3e6d752063b2180ab4464534f675d0fc173567eff14a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe
Size

1016KB
MD5

ce6875a52b1284f3d422818791504ef2
SHA1

5d71eb7d6f2e9fb1766878eefccc68e2d6a61741
SHA256

3c6f95d78d0b318086be3e6d752063b2180ab4464534f675d0fc173567eff14a
SHA512

2a387d1b52659e32d630879a73a89f491c17456eb26bc283d1f8ed89dfc4d13e553429868324342d840d5d122d6fac4bc41aa538ce15e6bb42e82137d34603b7
SSDEEP

24576:GsN4zxPj+yMU2G96cbdd7cicXSM0YQPxEmIJuH/WW8w:ngxL+DlG96cpdoiLYQ2mIJuCw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2480	RegAsm.exe
2480	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28
PID 2176 wrote to memory of 2480	2176	ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce6875a52b1284f3d422818791504ef2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/2176-1-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/2176-2-0x000000001ACA0000-0x000000001AD20000-memory.dmp

Filesize
512KB

Download
memory/2176-14-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/2480-5-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-15-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2480-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-3-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-4-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-23-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-25-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-27-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-28-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-31-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-33-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-34-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2480-36-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download