fb6c3d8a6b03ed7c43b1d55ea4b628e9c657f39fb68a3edaf70cd1ef615e681f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe
Size

6.3MB
MD5

97300ba006cb1a5ce8bc1d4e69976196
SHA1

818b6278605e0a8d783e6305f0d914153247aeb6
SHA256

fb6c3d8a6b03ed7c43b1d55ea4b628e9c657f39fb68a3edaf70cd1ef615e681f
SHA512

4fa63e52c6f4976877fb2be0fb1b705f7424342ce8857b0fc497df1de274932dfa2315ec4f75cf66a14356c34a5d9902084546659b37cdea744c0c104f1d0d83
SSDEEP

98304:7zeoDRJ/WoD1rHFMMMMMMMMMMMMMMMMMMp2MMMMMMMMMMMMMMMMMMXk4srTRPnpH:Pe0JvdTBvpRXxt+SeoNgC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
220	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe
220	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
220	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe
220	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92
PID 1860 wrote to memory of 220	1860	97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\97300ba006cb1a5ce8bc1d4e69976196_JaffaCakes118.exe" ""
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-1-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-3-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-2-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-4-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-6-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-7-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-8-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/220-9-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1860-0-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/1860-5-0x0000000000400000-0x00000000009DE000-memory.dmp

Filesize
5.9MB

Download