f8c6590b5e7bbf0a148bef40a990dce10617145aae267942ca427ff6d1a39ce8

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
Size

540KB
MD5

279185154a0aad5321ed4e37579f70b0
SHA1

020daccb61625c0fd64bf8ad62a05e41a34b728b
SHA256

f8c6590b5e7bbf0a148bef40a990dce10617145aae267942ca427ff6d1a39ce8
SHA512

7d05e17cfb08ba2851a0d48cc086c9f061230bbb44ddcce1d3387b1aa6f1df70391629bdde7e5de84b8001b48eabc48152d0f5ed69a14e5da506a6232b126222
SSDEEP

12288:LUxJmXn0arBSXwXZ7JM5+MZD7EO+hZn7od2+rp/n++jm:LUxJmXxAXwXZ7a+Mp7EOSB22+rp/n++C

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3104-5-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3104-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3104-8-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3104-18-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 3104 set thread context of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 5056 wrote to memory of 3104	5056	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	85
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 3104 wrote to memory of 1808	3104	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	86
PID 1808 wrote to memory of 3404	1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	56
PID 1808 wrote to memory of 3404	1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	56
PID 1808 wrote to memory of 3404	1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	56
PID 1808 wrote to memory of 3404	1808	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1808-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1808-19-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3104-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3104-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3104-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3104-18-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3404-20-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3404-21-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/5056-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/5056-1-0x0000000000401000-0x00000000004F7000-memory.dmp

Filesize
984KB

Download
memory/5056-12-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download