9d31a6bca4fc0930eedd9270e7b6be75eb9eae5de763098666171f5bd829c333

Analysis

max time kernel
137s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe
Size

114KB
MD5

1a604136eb9c15ea9c440a7e88284329
SHA1

b94eacde54b8e153f962f361ca70c0b8b968fc76
SHA256

9d31a6bca4fc0930eedd9270e7b6be75eb9eae5de763098666171f5bd829c333
SHA512

781b4e8ba38494c2df919da044dec261f1ab4a98341476ec64ea0cfab8160884f765dc977bd87af2333c4575dee65b0dfe0c64a66cca8e2a2229d20335432583
SSDEEP

3072:h6D3SstHQpo4GsK05/Druvh/UhN+ubmemUWEk:8DJHshPK05/sh/U3+uqrU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3016	taskmgr32.exe
4884	taskmgr32.exe
1524	taskmgr32.exe
220	taskmgr32.exe
4504	taskmgr32.exe
4036	taskmgr32.exe
3552	taskmgr32.exe
4736	taskmgr32.exe
1548	taskmgr32.exe
2588	taskmgr32.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe
File created	C:\Windows\SysWOW64\taskmgr32.exe	taskmgr32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 3016	1568	1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe	83
PID 1568 wrote to memory of 3016	1568	1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe	83
PID 1568 wrote to memory of 3016	1568	1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe	83
PID 3016 wrote to memory of 4884	3016	taskmgr32.exe	95
PID 3016 wrote to memory of 4884	3016	taskmgr32.exe	95
PID 3016 wrote to memory of 4884	3016	taskmgr32.exe	95
PID 4884 wrote to memory of 1524	4884	taskmgr32.exe	97
PID 4884 wrote to memory of 1524	4884	taskmgr32.exe	97
PID 4884 wrote to memory of 1524	4884	taskmgr32.exe	97
PID 1524 wrote to memory of 220	1524	taskmgr32.exe	100
PID 1524 wrote to memory of 220	1524	taskmgr32.exe	100
PID 1524 wrote to memory of 220	1524	taskmgr32.exe	100
PID 220 wrote to memory of 4504	220	taskmgr32.exe	101
PID 220 wrote to memory of 4504	220	taskmgr32.exe	101
PID 220 wrote to memory of 4504	220	taskmgr32.exe	101
PID 4504 wrote to memory of 4036	4504	taskmgr32.exe	104
PID 4504 wrote to memory of 4036	4504	taskmgr32.exe	104
PID 4504 wrote to memory of 4036	4504	taskmgr32.exe	104
PID 4036 wrote to memory of 3552	4036	taskmgr32.exe	105
PID 4036 wrote to memory of 3552	4036	taskmgr32.exe	105
PID 4036 wrote to memory of 3552	4036	taskmgr32.exe	105
PID 3552 wrote to memory of 4736	3552	taskmgr32.exe	108
PID 3552 wrote to memory of 4736	3552	taskmgr32.exe	108
PID 3552 wrote to memory of 4736	3552	taskmgr32.exe	108
PID 4736 wrote to memory of 1548	4736	taskmgr32.exe	109
PID 4736 wrote to memory of 1548	4736	taskmgr32.exe	109
PID 4736 wrote to memory of 1548	4736	taskmgr32.exe	109
PID 1548 wrote to memory of 2588	1548	taskmgr32.exe	113
PID 1548 wrote to memory of 2588	1548	taskmgr32.exe	113
PID 1548 wrote to memory of 2588	1548	taskmgr32.exe	113

C:\Users\Admin\AppData\Local\Temp\1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\taskmgr32.exe
  C:\Windows\system32\taskmgr32.exe 1032 "C:\Users\Admin\AppData\Local\Temp\1a604136eb9c15ea9c440a7e88284329_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\taskmgr32.exe
    C:\Windows\system32\taskmgr32.exe 1156 "C:\Windows\SysWOW64\taskmgr32.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SysWOW64\taskmgr32.exe
      C:\Windows\system32\taskmgr32.exe 1128 "C:\Windows\SysWOW64\taskmgr32.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1124 "C:\Windows\SysWOW64\taskmgr32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1132 "C:\Windows\SysWOW64\taskmgr32.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1136 "C:\Windows\SysWOW64\taskmgr32.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1148 "C:\Windows\SysWOW64\taskmgr32.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1140 "C:\Windows\SysWOW64\taskmgr32.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1144 "C:\Windows\SysWOW64\taskmgr32.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\taskmgr32.exe
        
        C:\Windows\system32\taskmgr32.exe 1152 "C:\Windows\SysWOW64\taskmgr32.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\taskmgr32.exe

Filesize
114KB

MD5
1a604136eb9c15ea9c440a7e88284329

SHA1
b94eacde54b8e153f962f361ca70c0b8b968fc76

SHA256
9d31a6bca4fc0930eedd9270e7b6be75eb9eae5de763098666171f5bd829c333

SHA512
781b4e8ba38494c2df919da044dec261f1ab4a98341476ec64ea0cfab8160884f765dc977bd87af2333c4575dee65b0dfe0c64a66cca8e2a2229d20335432583

Download Submit
memory/220-19-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/220-16-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1524-13-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1524-17-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1548-34-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1548-30-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1568-8-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1568-0-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/2588-33-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3016-11-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3016-7-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3552-24-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3552-28-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4036-21-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4036-25-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4504-22-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4736-27-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4736-31-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4884-14-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4884-10-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads