7002c54c1425d85fc7574ac718272076178852668c70400afcb903c83a0375db

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe
Size

707KB
MD5

f11f4b77e753d376fdc2526d88e15e74
SHA1

451b78624055a94f5390b6c1d5772bc8ffe3f061
SHA256

7002c54c1425d85fc7574ac718272076178852668c70400afcb903c83a0375db
SHA512

715e1146a9761df7ec2fe0171f46002e7feaa496ae46e0ffd9213cf27ceba7b8c7b40fd870707117ac740a78f3d96bd4030071c3128500321acfb15b0b42fb99
SSDEEP

12288:0xEVBEu4+lz5y/GazAH8yX3dz5R0NVeaHWEORU:nVK4yfzAPndFR0N4aUu

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2364	svchost.exe
2364	svchost.exe
2364	svchost.exe
2364	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2220 wrote to memory of 2364	2220	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	97
PID 2364 wrote to memory of 2408	2364	svchost.exe	42
PID 2364 wrote to memory of 2408	2364	svchost.exe	42
PID 2364 wrote to memory of 2408	2364	svchost.exe	42
PID 2364 wrote to memory of 2408	2364	svchost.exe	42
PID 2364 wrote to memory of 2408	2364	svchost.exe	42
PID 2364 wrote to memory of 2512	2364	svchost.exe	46
PID 2364 wrote to memory of 2512	2364	svchost.exe	46
PID 2364 wrote to memory of 2512	2364	svchost.exe	46
PID 2364 wrote to memory of 2512	2364	svchost.exe	46
PID 2364 wrote to memory of 2512	2364	svchost.exe	46
PID 2364 wrote to memory of 3336	2364	svchost.exe	57
PID 2364 wrote to memory of 3336	2364	svchost.exe	57
PID 2364 wrote to memory of 3336	2364	svchost.exe	57
PID 2364 wrote to memory of 3336	2364	svchost.exe	57
PID 2364 wrote to memory of 3336	2364	svchost.exe	57
PID 2364 wrote to memory of 3736	2364	svchost.exe	59
PID 2364 wrote to memory of 3736	2364	svchost.exe	59
PID 2364 wrote to memory of 3736	2364	svchost.exe	59
PID 2364 wrote to memory of 3736	2364	svchost.exe	59
PID 2364 wrote to memory of 3736	2364	svchost.exe	59
PID 2364 wrote to memory of 3840	2364	svchost.exe	60
PID 2364 wrote to memory of 3840	2364	svchost.exe	60
PID 2364 wrote to memory of 3840	2364	svchost.exe	60
PID 2364 wrote to memory of 3840	2364	svchost.exe	60
PID 2364 wrote to memory of 3840	2364	svchost.exe	60
PID 2364 wrote to memory of 3960	2364	svchost.exe	61
PID 2364 wrote to memory of 3960	2364	svchost.exe	61
PID 2364 wrote to memory of 3960	2364	svchost.exe	61
PID 2364 wrote to memory of 3960	2364	svchost.exe	61
PID 2364 wrote to memory of 3960	2364	svchost.exe	61
PID 2364 wrote to memory of 3648	2364	svchost.exe	63
PID 2364 wrote to memory of 3648	2364	svchost.exe	63
PID 2364 wrote to memory of 3648	2364	svchost.exe	63
PID 2364 wrote to memory of 3648	2364	svchost.exe	63
PID 2364 wrote to memory of 3648	2364	svchost.exe	63
PID 2364 wrote to memory of 2204	2364	svchost.exe	65
PID 2364 wrote to memory of 2204	2364	svchost.exe	65
PID 2364 wrote to memory of 2204	2364	svchost.exe	65
PID 2364 wrote to memory of 2204	2364	svchost.exe	65
PID 2364 wrote to memory of 2204	2364	svchost.exe	65
PID 2364 wrote to memory of 2404	2364	svchost.exe	75
PID 2364 wrote to memory of 2404	2364	svchost.exe	75
PID 2364 wrote to memory of 2404	2364	svchost.exe	75
PID 2364 wrote to memory of 2404	2364	svchost.exe	75
PID 2364 wrote to memory of 2404	2364	svchost.exe	75
PID 2364 wrote to memory of 4880	2364	svchost.exe	77
PID 2364 wrote to memory of 4880	2364	svchost.exe	77
PID 2364 wrote to memory of 4880	2364	svchost.exe	77
PID 2364 wrote to memory of 4880	2364	svchost.exe	77
PID 2364 wrote to memory of 4880	2364	svchost.exe	77
PID 2364 wrote to memory of 1528	2364	svchost.exe	78
PID 2364 wrote to memory of 1528	2364	svchost.exe	78
PID 2364 wrote to memory of 1528	2364	svchost.exe	78
PID 2364 wrote to memory of 1528	2364	svchost.exe	78
PID 2364 wrote to memory of 1528	2364	svchost.exe	78
PID 2364 wrote to memory of 3516	2364	svchost.exe	79

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2408

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2512

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Temp\f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\SYSTEM32\RuntimeBroker.exe
      RuntimeBroker.exe
      4⤵
      PID:4756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3736

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2204

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffea3b92e98,0x7ffea3b92ea4,0x7ffea3b92eb0
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2276 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3196 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3340 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5376 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5356 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-66-0x000000001F850000-0x000000001F85A000-memory.dmp

Filesize
40KB

Download
memory/2220-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2220-2-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/2220-13-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2220-1-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2364-3-0x0000000000F00000-0x0000000000F26000-memory.dmp

Filesize
152KB

Download
memory/2364-15-0x0000000000F00000-0x0000000000F26000-memory.dmp

Filesize
152KB

Download
memory/2364-16-0x0000000000F00000-0x0000000000F26000-memory.dmp

Filesize
152KB

Download
memory/2364-17-0x0000000000F00000-0x0000000000F26000-memory.dmp

Filesize
152KB

Download
memory/2404-72-0x0000000002A90000-0x0000000002A9A000-memory.dmp

Filesize
40KB

Download
memory/2408-24-0x0000000018A80000-0x0000000018A8A000-memory.dmp

Filesize
40KB

Download
memory/2512-30-0x000000002C4D0000-0x000000002C4DA000-memory.dmp

Filesize
40KB

Download
memory/3336-36-0x0000000001540000-0x000000000154A000-memory.dmp

Filesize
40KB

Download
memory/3648-60-0x000000001BDB0000-0x000000001BDBA000-memory.dmp

Filesize
40KB

Download
memory/3736-42-0x000000003FCF0000-0x000000003FCFA000-memory.dmp

Filesize
40KB

Download
memory/3840-48-0x000000000CE40000-0x000000000CE4A000-memory.dmp

Filesize
40KB

Download
memory/3960-54-0x000000003A840000-0x000000003A84A000-memory.dmp

Filesize
40KB

Download