1f060ed4f026137c3d684c132fb462d7a38d3098af0f319771f8f43cb4f6ed2f

Analysis

max time kernel
133s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
Size

145KB
MD5

1599046094fe2eeaf7933f49456e466b
SHA1

7a5d1d7d34a074df3870171efb75f55c7bf2127f
SHA256

1f060ed4f026137c3d684c132fb462d7a38d3098af0f319771f8f43cb4f6ed2f
SHA512

d0e25fc5f7baa8bf9545b61f2d4d231b612ad8c098b9c0fd8689ca3a68a17c25a2878b254b4e3535aa1bb7786eb9114e08406ed7b2950593a26fa7f964bc97ec
SSDEEP

3072:qGwm//Oqx8O6tFYB3dOnaLR3HP+uCLEwT5GOZoLRXyg5IBJ/:qGw20O6tFXnSR32REwVWL0V5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3620 set thread context of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 1076 set thread context of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	4948	WerFault.exe	91

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 3620 wrote to memory of 1076	3620	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	90
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91
PID 1076 wrote to memory of 4948	1076	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
    3⤵
    PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 456
      4⤵
      Program crash
      PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4948 -ip 4948
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4472,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
1⤵
PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1076-16-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/1076-18-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1076-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1076-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3620-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3620-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3620-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3620-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3620-2-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/3620-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4948-15-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4948-20-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads