31e0f6ede49814788731b54c69b51e4b5c84dca48b1743edc62ab49918451feb

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe
Size

420KB
MD5

f2ae458003d0f25d32409e9cf9c647a6
SHA1

de64263d03e2fd9feb59c9aba19a1829c50365ba
SHA256

31e0f6ede49814788731b54c69b51e4b5c84dca48b1743edc62ab49918451feb
SHA512

ab31130c2fa297d6b71f38611e8463b8cf0289e2eff75b372c99ff67b1047643a4e0a239302de4954980c09a94ca3169130d75672314817c6ca0c38c1a546d8f
SSDEEP

6144:lohXRDGdv0IL9vhT8Ge4PqQoB8zQs7f4OLxWQE7ZtD3QXO4OZ:lABDGdlL9GNuqA7fHo7DbQU

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe
4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe
4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe
4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 2732 wrote to memory of 4500	2732	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	85
PID 4500 wrote to memory of 3460	4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	57
PID 4500 wrote to memory of 3460	4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	57
PID 4500 wrote to memory of 3460	4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	57
PID 4500 wrote to memory of 3460	4500	f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f2ae458003d0f25d32409e9cf9c647a6_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-21-0x0000000076BC0000-0x0000000076CB0000-memory.dmp

Filesize
960KB

Download
memory/2732-6-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2732-2-0x00000000021E0000-0x0000000002219000-memory.dmp

Filesize
228KB

Download
memory/2732-4-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2732-3-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2732-5-0x0000000077552000-0x0000000077553000-memory.dmp

Filesize
4KB

Download
memory/2732-11-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/2732-7-0x0000000076BC0000-0x0000000076CB0000-memory.dmp

Filesize
960KB

Download
memory/2732-8-0x0000000077553000-0x0000000077554000-memory.dmp

Filesize
4KB

Download
memory/2732-9-0x0000000077543000-0x0000000077544000-memory.dmp

Filesize
4KB

Download
memory/2732-1-0x00000000021A0000-0x00000000021A4000-memory.dmp

Filesize
16KB

Download
memory/2732-12-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2732-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2732-20-0x00000000021E0000-0x0000000002219000-memory.dmp

Filesize
228KB

Download
memory/2732-18-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3460-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3460-24-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4500-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4500-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4500-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4500-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4500-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4500-28-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4500-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download