d62ed0598fb36181ba8411d65726ba4ea6b854b5ec05005fafb2d1e3a29f3230

Analysis

max time kernel
44s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
Size

745KB
MD5

1afe05962b645245364b0b5fb5edcd40
SHA1

b703ef183116ffb4558c850e7465c03e57d58c61
SHA256

d62ed0598fb36181ba8411d65726ba4ea6b854b5ec05005fafb2d1e3a29f3230
SHA512

417fe0aeb689aedb4a5a10059b5949a5081cf564b3a846f3936cdaa88658d1804e841f58c55987e9a1b718a1be7fabfcf6221fc3768b40147079b3bfa6fcc16b
SSDEEP

12288:i0cwtN4AKg8YF5LKdSo0kyuNDXa7WrARKibXe4K/lGRgOUqmq9kR6lhKXkGZWKVZ:3Xj8iKdSGDXa7k2K/cRgOnmq9g6XGgK/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 set thread context of 0	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 1496	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	80
PID 1980 wrote to memory of 0	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
PID 1980 wrote to memory of 0	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
PID 1980 wrote to memory of 0	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
PID 1980 wrote to memory of 0	1980	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
PID 1496 wrote to memory of 3516	1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	56
PID 1496 wrote to memory of 3516	1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	56
PID 1496 wrote to memory of 3516	1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	56
PID 1496 wrote to memory of 3516	1496	1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3516
- C:\Users\Admin\AppData\Local\Temp\1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1afe05962b645245364b0b5fb5edcd40_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1496-49-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1496-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-37-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-44-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-11-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-7-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1980-6-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1980-10-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-8-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-18-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-26-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-35-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-47-0x00000000021A0000-0x0000000002200000-memory.dmp

Filesize
384KB

Download
memory/1980-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Filesize
384KB

Download
memory/1980-48-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-46-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1980-45-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-34-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-43-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-42-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-40-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-39-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-38-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1980-9-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-36-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-17-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-32-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-31-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-30-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-29-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-28-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-27-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-25-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-24-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-23-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-22-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-21-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-20-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-19-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-33-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-16-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/1980-5-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1980-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/1980-3-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/1980-2-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3516-51-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3516-52-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download