f301c1333092e0e4f1ae61329d28421f8b638c38aad9b75bef89d4dd37f950ae

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe
Size

6KB
MD5

feafc4d8aeb7568100994486f29c3280
SHA1

f76845ee284d5264acabeacf5155f3101087ab02
SHA256

f301c1333092e0e4f1ae61329d28421f8b638c38aad9b75bef89d4dd37f950ae
SHA512

6ceed3d2fa9dbf40993161082db86f10dfb11f26def20f7a8f686cc4f57cbea7bc36611066bde82526ad1c697cdebc72d6d66160bfc63e4697f2eb53863bab8f
SSDEEP

96:Bu18SnwZ33eiAjhwSvaeblGg3qEDf1ptvH:eLnwZne1j1vmg3qU1

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe
3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 0	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 4028 wrote to memory of 3968	4028	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	87
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57
PID 3968 wrote to memory of 3504	3968	feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3504
- C:\Users\Admin\AppData\Local\Temp\feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\feafc4d8aeb7568100994486f29c3280_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3968-4-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3968-5-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4028-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4028-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download