0b54167af1bf9399968669689b5f6c619e308ed629edfd8316e6d28413cbe4ef

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
Size

258KB
MD5

24306b3a9175200af06e074d78b5245c
SHA1

abf946f705480988a6eba50422d7869c3e314f0c
SHA256

0b54167af1bf9399968669689b5f6c619e308ed629edfd8316e6d28413cbe4ef
SHA512

5c9770d728c7d240048b1ae72734ab500706c610227e52028116f6470c121a1bc956a447d7733d755c1ff9c5c75205593ffee1275378761589dedcf9d964824c
SSDEEP

6144:8szuJ0Y6rnePUgnVW5GJZ2tNYLj8Mfsajuo6aMoP/nQ:LY6CPUwVzYKj86sim

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3348 set thread context of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 3348 wrote to memory of 4928	3348	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	81
PID 4928 wrote to memory of 3496	4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	56
PID 4928 wrote to memory of 3496	4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	56
PID 4928 wrote to memory of 3496	4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	56
PID 4928 wrote to memory of 3496	4928	24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3496
- C:\Users\Admin\AppData\Local\Temp\24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Users\Admin\AppData\Local\Temp\24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\24306b3a9175200af06e074d78b5245c_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-0-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3348-1-0x0000000002B50000-0x0000000002B58000-memory.dmp

Filesize
32KB

Download
memory/3348-5-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-4-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-3-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-7-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-13-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-25-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-24-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-23-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-22-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-21-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-20-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-26-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-19-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-18-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-17-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-16-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-15-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-14-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-12-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-11-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-10-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-9-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-8-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-6-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-35-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/3348-47-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/3348-46-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/3348-45-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3348-44-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/3348-43-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/3348-42-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3348-41-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/3348-40-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Filesize
4KB

Download
memory/3348-39-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/3348-38-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/3348-34-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3348-33-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3348-32-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/3348-31-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/3348-30-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3348-29-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/3348-28-0x0000000000680000-0x0000000000690000-memory.dmp

Filesize
64KB

Download
memory/3348-37-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3348-36-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/3348-53-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/3348-52-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/3348-51-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/3348-50-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/3348-58-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3496-59-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4928-48-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-49-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-54-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4928-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-63-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download