06f4b2ec2046f9a1b0e5b3bf170fabf3ddda0ee32c87d4beea125b98d3fa7aa6

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe
Size

1.5MB
MD5

20cb9c0a739e406a6514f72f8a4cc958
SHA1

a6bb6ad1e4ecf713b9156d1922a24df9e5dfa033
SHA256

06f4b2ec2046f9a1b0e5b3bf170fabf3ddda0ee32c87d4beea125b98d3fa7aa6
SHA512

7a547ec6a93bfd492500c6ce090e4baac2d81b2133c7c87bc441e930ff97fcb178c56f8db0008caf75226281d57a4935ec27c4e0e5b25ed678671c734882f8bf
SSDEEP

24576:sK9R5C60T18zPGdId6DD6k0XwxqonlBQHO2Wdr8yNWUi6jfo7iVq:sKL5g8CmslvYonlBsOT8yNWUBwic

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe
1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	1760	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe
1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2628	1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe	28
PID 1760 wrote to memory of 2628	1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe	28
PID 1760 wrote to memory of 2628	1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe	28
PID 1760 wrote to memory of 2628	1760	20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20cb9c0a739e406a6514f72f8a4cc958_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 344
  2⤵
  - Program crash
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-0-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1760-1-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-3-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-9-0x000000007782F000-0x0000000077830000-memory.dmp

Filesize
4KB

Download
memory/1760-14-0x000000007782F000-0x0000000077830000-memory.dmp

Filesize
4KB

Download
memory/1760-12-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-10-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-7-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-15-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-17-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-19-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download
memory/1760-22-0x0000000077830000-0x0000000077831000-memory.dmp

Filesize
4KB

Download
memory/1760-23-0x00000000779A0000-0x00000000779A1000-memory.dmp

Filesize
4KB

Download
memory/1760-21-0x000000007782F000-0x0000000077830000-memory.dmp

Filesize
4KB

Download
memory/1760-24-0x0000000002030000-0x0000000002074000-memory.dmp

Filesize
272KB

Download
memory/1760-29-0x0000000002030000-0x0000000002074000-memory.dmp

Filesize
272KB

Download
memory/1760-30-0x0000000000400000-0x00000000007E3000-memory.dmp

Filesize
3.9MB

Download