23d42a3c0b26e6b97d8114d33b8049ea44b926812d957867838487a7638042d5

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
Size 1.2MB
Sample240602-199sashb5w
SHA256 23d42a3c0b26e6b97d8114d33b8049ea44b926812d957867838487a7638042d5
MD5 8fa20c5f40cb1e58a84270f21159cf93
SHA1 8292dca095bdd8c9408f59ecf3e9801537dcf46d
SHA512 b64b761bd1b33d9f7b6c5583b8e68918954e3a971dd2e27e59050cc7428506ae00377d0fe38ea881589c83fe5a785c25c5322f892145166fde38782b6b324612
SSDEEP 24576:zB8/cykaJJJJJJJJJJJJJ7JJJJJOnOnOnOn3xwwncncnJEGBAFPJi6lAPSdHWOx5:zBIqBdHpx+QgFgoYO
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3748 set thread context of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5056	2732	WerFault.exe	83
3096	2732	WerFault.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2732	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
2732	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
2732	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
2732	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
2732	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83
PID 3748 wrote to memory of 2732	3748	8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8fa20c5f40cb1e58a84270f21159cf93_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 2044
    3⤵
    - Program crash
    PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 2016
    3⤵
    - Program crash
    PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2732 -ip 2732
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2732 -ip 2732
1⤵
PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2732-1-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2732-2-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2732-3-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2732-4-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2732-5-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2732-6-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads