Overview

overview

5

Static

static

3

0d65229b8b...18.exe

windows7-x64

5

0d65229b8b...18.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 08:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0d65229b8b0ae1043fc17a3329ef2f2f_JaffaCakes118.exe

  • Size

    137KB

  • MD5

    0d65229b8b0ae1043fc17a3329ef2f2f

  • SHA1

    a9f12c3eac1e3cb219bc65678eb769439af29814

  • SHA256

    9b4bbcc41b23eb119aee02cfc5e3c8ff66575a3e025d8e203394b6541d964e1a

  • SHA512

    56bc9d4419b932461e2fbdfbfe73b676046441c6cdfc9e549525277347793c6e195402a925a686c37c4ba6ff395b259245f1f186bbb7b44fc37b726c7da9e370

  • SSDEEP

    3072:Gy3HapURGR1IuOT8yzB4u1aCpI+ZS9AKj9n99tzPV8tsjayM:GyKplw8yd4exI+ZSSK97tzPV8tsj3M

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d65229b8b0ae1043fc17a3329ef2f2f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d65229b8b0ae1043fc17a3329ef2f2f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\0d65229b8b0ae1043fc17a3329ef2f2f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0d65229b8b0ae1043fc17a3329ef2f2f_JaffaCakes118.exe D:\Hex Projects\wnd.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 148
        3⤵
        • Program crash
        PID:1808

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2392-7-0x0000000060000000-0x0000000060030000-memory.dmp

          Filesize

          192KB

          Download

        • memory/3044-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3044-5-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

          Download

        • memory/3044-3-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

          Download

        • memory/3044-6-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

          Download

        • memory/3044-0-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

          Download