Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
13/06/2024, 00:41
General
-
Target
a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe
-
Size
776KB
-
MD5
a3324799baf5f93b04334e42d4e25ce2
-
SHA1
952249d2ffb4f4f9ba41669be0309973fc071704
-
SHA256
1062ee4302ed8c5f97bb35548bc6ad57909aef85e7d632362a2dfd266abf6c0e
-
SHA512
2d8b9f419cba6e95d35d6564b0a2c26c2c76eb67b619c3ce585fa8421367aea51eee3011fb4a1dc1050f856ad4c677dffbd404ded1c7892a5387dbce69ee3146
-
SSDEEP
12288:xG34RGZbsqt/egpPeu83dUAAO5K5Ye7iQ0y/XqbrRtMPbhlLBQ:w64sqt2wq0jq2iQ0UXqbrRt0TLBQ
Score
7/10
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 19763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 19403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 100 -ip 1001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 100 -ip 1001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
992KB