2beb88afa4c3293925fc8175d654d135c60e4aa5303616ab13f040a771370411

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
Size 98KB
Sample240427-j54baaee76
SHA256 2beb88afa4c3293925fc8175d654d135c60e4aa5303616ab13f040a771370411
MD5 02cf184b6b3655d8a8cfc46d3ad98130
SHA1 d0fa3b894c09f856e9c882d922a9d288c23e0a38
SHA512 3a3b6dd96c2bdfe5f9ca0b7297173cf9d454ac9c1ea61387900cfc782ab000dc858c287eb5ffea154248b212dcfb26b1b7b5f026485fdfe3e76fdca7bd0d0407
SSDEEP 1536:0MWO4O9IR5Zw1WvO1+QrK/F2BZhWv0ua/Kub/HPHn5ujt+UYxPfMVxe:0ML4O96w0G1+au2BZhWMuaCwv4IPf1
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4992 set thread context of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2636	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
2636	winver.exe
2636	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3420	Explorer.EXE
Token: SeCreatePagefilePrivilege	3420	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	winver.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3420	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 4992 wrote to memory of 3472	4992	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	82
PID 3472 wrote to memory of 2636	3472	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	83
PID 3472 wrote to memory of 2636	3472	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	83
PID 3472 wrote to memory of 2636	3472	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	83
PID 3472 wrote to memory of 2636	3472	02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe	83
PID 2636 wrote to memory of 3420	2636	winver.exe	56
PID 2636 wrote to memory of 2956	2636	winver.exe	50

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2956

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3420
- C:\Users\Admin\AppData\Local\Temp\02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\02cf184b6b3655d8a8cfc46d3ad98130_JaffaCakes118.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 400
        5⤵
        Program crash
        
        PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2636 -ip 2636
1⤵
PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-9-0x00000000772A2000-0x00000000772A3000-memory.dmp

Download

memory/2636-11-0x00000000012A0000-0x00000000012A6000-memory.dmp

Download

memory/2636-17-0x00000000012A0000-0x00000000012A6000-memory.dmp

Download

memory/2636-5-0x00000000012A0000-0x00000000012A6000-memory.dmp

Download

memory/2636-10-0x0000000000D90000-0x0000000000DA2000-memory.dmp

Download

memory/2956-16-0x00000000008D0000-0x00000000008D6000-memory.dmp

Download

memory/3420-4-0x0000000002260000-0x0000000002266000-memory.dmp

Download

memory/3420-8-0x00007FFF7082D000-0x00007FFF7082E000-memory.dmp

Download

memory/3420-12-0x00007FFF709C0000-0x00007FFF709C1000-memory.dmp

Download

memory/3420-3-0x0000000002260000-0x0000000002266000-memory.dmp

Download

memory/3472-7-0x00000000017A0000-0x00000000021A0000-memory.dmp

Download

memory/3472-14-0x0000000000400000-0x0000000000404400-memory.dmp

Download

memory/3472-1-0x0000000000400000-0x000000000149A000-memory.dmp

Download

memory/4992-0-0x0000000002260000-0x0000000002264000-memory.dmp

Download

memory/4992-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download