63124b098e33791b588eaa9c0dbe49cc3305e396a1a9f220476eb57431b856aa

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe
Size

396KB
MD5

026a18ccbe1763f483f7a976b84a82c2
SHA1

a1a5415b16be40d2098864b0c2a61a4926fb40ab
SHA256

63124b098e33791b588eaa9c0dbe49cc3305e396a1a9f220476eb57431b856aa
SHA512

87a485e147caaa8799a9756a00cba8ae1cfbe12d88700ffe4eb6a8a8cb8f8c27a379d7bec640028bd48e77aab665fbfab24fce5fbf3ca24f7b3144cacc63efc6
SSDEEP

12288:RwQzXK/lGRgOUqmq9kR6lhKXiB3a9FsqJKB57d8fsR670lN0:WQK/cRgOnmq9g6zB36rKX6UR670lO

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	3116	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85
PID 1532 wrote to memory of 3116	1532	026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\026a18ccbe1763f483f7a976b84a82c2_JaffaCakes118.exe
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 540
    3⤵
    - Program crash
    PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3116 -ip 3116
1⤵
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-11-0x00000000039A0000-0x00000000039AB000-memory.dmp

Filesize
44KB

Download
memory/1532-9-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/1532-2-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1532-10-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1532-24-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1532-23-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/1532-22-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/1532-21-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/1532-0-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1532-19-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/1532-18-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/1532-17-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1532-16-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1532-15-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/1532-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Filesize
384KB

Download
memory/1532-14-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/1532-20-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1532-13-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/1532-8-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/1532-7-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1532-6-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1532-5-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/1532-4-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1532-3-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1532-27-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1532-26-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/1532-32-0x0000000002160000-0x00000000021C0000-memory.dmp

Filesize
384KB

Download
memory/1532-31-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3116-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3116-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3116-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3116-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads