901158d271fa5d3e0f6835ac9e2ff57e637a9804c57c75445dba5509e0fc4472 | Triage

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 06:31

Sharing

Report Analysis Logs

General

Target

2b512e2b61204b4b7964f5ee35e06f88_JaffaCakes118.exe
Size

81KB
MD5

2b512e2b61204b4b7964f5ee35e06f88
SHA1

f5a738bc87f101a4726947b02f2c18c86105138e
SHA256

901158d271fa5d3e0f6835ac9e2ff57e637a9804c57c75445dba5509e0fc4472
SHA512

5cd525c9d27a89491cd62a9337385baad5c5aedcfd6301994d4d4b4b2878ae0ddac38b2bf9f6f3dc680a7d8cc877f72309622093cf8b8f707b84759dbf8d6c5e
SSDEEP

1536:+Nyy4jdDcrejmC2KpaAB1pga554rWAoWgJPn:gyXd2GJBbH71

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 5096 set thread context of 0	5096	2b512e2b61204b4b7964f5ee35e06f88_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5096	2b512e2b61204b4b7964f5ee35e06f88_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2b512e2b61204b4b7964f5ee35e06f88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b512e2b61204b4b7964f5ee35e06f88_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-0-0x0000000000416000-0x0000000000427000-memory.dmp

Filesize
68KB

Download
memory/5096-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5096-4-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5096-3-0x0000000000416000-0x0000000000427000-memory.dmp

Filesize
68KB

Download