c57e23b7936dfba490f3905dddec69fa0caad69050084bd5dbca9515062e3ecf

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe
Size

965KB
MD5

336ff1f649c1668c55da321fd7f7c601
SHA1

134ecd10840f23372c2b54c477dd38b30b3eab88
SHA256

c57e23b7936dfba490f3905dddec69fa0caad69050084bd5dbca9515062e3ecf
SHA512

e4ba2835925b7f11a8eb9cb38b2e261cabac2480bc97205089ccaa9a79302e0feb8ef89af88733b9ead284ea923df0a35cb66b4b34e4a7ea669d0ddde0f7c8f5
SSDEEP

12288:LYcN4UcDwO100pC1RSdbWQMwA/76xF+sBW18pcywSBfL8XQQjYH5:edld3DMwAo+4W18iywSlL8QQjYH5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ÝZ\server.exe	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.EXE
File created	C:\Program Files (x86)\ÝZ\server.exe	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.EXE
Token: SeDebugPrivilege	4544	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83
PID 1704 wrote to memory of 4544	1704	336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.EXE
  "C:\Users\Admin\AppData\Local\Temp\336ff1f649c1668c55da321fd7f7c601_JaffaCakes118.EXE"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/1704-9-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/1704-11-0x0000000002250000-0x0000000002260000-memory.dmp

Filesize
64KB

Download
memory/1704-10-0x0000000002240000-0x0000000002250000-memory.dmp

Filesize
64KB

Download
memory/1704-8-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/1704-7-0x00000000021F0000-0x0000000002200000-memory.dmp

Filesize
64KB

Download
memory/1704-6-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download
memory/1704-5-0x00000000021D0000-0x00000000021E0000-memory.dmp

Filesize
64KB

Download
memory/1704-4-0x00000000021C0000-0x00000000021D0000-memory.dmp

Filesize
64KB

Download
memory/1704-3-0x00000000021B0000-0x00000000021C0000-memory.dmp

Filesize
64KB

Download
memory/1704-2-0x00000000021A0000-0x00000000021B0000-memory.dmp

Filesize
64KB

Download
memory/1704-1-0x0000000002190000-0x00000000021A0000-memory.dmp

Filesize
64KB

Download
memory/1704-12-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/1704-14-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/1704-15-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

Filesize
64KB

Download
memory/1704-17-0x0000000002B10000-0x0000000002B20000-memory.dmp

Filesize
64KB

Download
memory/1704-16-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Filesize
64KB

Download
memory/1704-13-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/4544-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4544-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4544-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4544-23-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4544-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4544-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4544-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4544-31-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download