9f8d001690b94e75dbb5e8522a86ee25838c43d66ab2e20a2e26c465c49207a0

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
Size

340KB
MD5

2ad1f2f3b4b2b535d1948448db0bfeba
SHA1

d979a2eacf211dc13abff95ab3b602fe7afe1d12
SHA256

9f8d001690b94e75dbb5e8522a86ee25838c43d66ab2e20a2e26c465c49207a0
SHA512

a92a3f17222522b363c5b9280067671b900f95795e889632f8b911987937d8fd1d7be1db9a97e8ae489340a4b40dd6a5108239266ad9149d9abaa233532e425b
SSDEEP

6144:deTKUiiIKYFXbbYO3XFE4uh9nVW5GJZ2tNYLj8MfsWwBv8L79Vd:YTKY+XbbYT4uhFVzYKj86sWK87rd

Score

1^/10

Malware Config

Signatures

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 3460	1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	56
PID 1892 wrote to memory of 3460	1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	56
PID 1892 wrote to memory of 3460	1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	56
PID 1892 wrote to memory of 3460	1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	56
PID 1892 wrote to memory of 3460	1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	56
PID 1892 wrote to memory of 3460	1892	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-20-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-49-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1892-29-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-41-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1892-40-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/1892-39-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/1892-38-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/1892-37-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1892-36-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1892-35-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1892-34-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1892-33-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1892-32-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/1892-31-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1892-28-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-27-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1892-25-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-24-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-23-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-22-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-21-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-18-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/1892-26-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-17-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-16-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-15-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-14-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-13-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-12-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-11-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-10-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-9-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-8-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-7-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-42-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1892-6-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-5-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-3-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1892-2-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1892-1-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1892-50-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1892-19-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/3460-45-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download