Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 08:48

General

  • Target

    a4b31430be906470eafa8846db67543d_JaffaCakes118.exe

  • Size

    80KB

  • MD5

    a4b31430be906470eafa8846db67543d

  • SHA1

    cbbbd541d4ce24116649f0d8f1eec717d751996e

  • SHA256

    1ba533d70a278927e49d638c2c5249cd7a280e3d730920c23e21a843359840fa

  • SHA512

    7e4f7cd094cce3f30d2cabfb7dc09c7f5107ce0cb8ff2f622937326bb5a450edf57c71684ad51ef2fe86c761537f808f29bd463f5f528238206fccf36143b107

  • SSDEEP

    768:ncsHhWJXQkIPTosRv55BwBduUoNdytaQdaxHIvVozL53bBJp/5SMl3X20AIl64d:nh8JXNQdRv55v3dSaQEmd8X/5BnXj

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4b31430be906470eafa8846db67543d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4b31430be906470eafa8846db67543d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\a4b31430be906470eafa8846db67543d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a4b31430be906470eafa8846db67543d_JaffaCakes118.exe"
      2⤵
        PID:1776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1776-17-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-5-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-18-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-19-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-16-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-12-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-15-0x0000000000406000-0x0000000000408000-memory.dmp

      Filesize

      8KB

    • memory/1776-7-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-11-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-4-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-13-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-14-0x0000000000400000-0x0000000002728000-memory.dmp

      Filesize

      35.2MB

    • memory/1776-31-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-1-0x00000000001B0000-0x00000000002AA000-memory.dmp

      Filesize

      1000KB

    • memory/1776-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1776-20-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-21-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-22-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-23-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-24-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-25-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-26-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-28-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-29-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1776-30-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2224-0-0x0000000000250000-0x0000000000254000-memory.dmp

      Filesize

      16KB