Overview

overview

7

Static

static

3

3388d780f4...18.exe

windows7-x64

7

3388d780f4...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    95s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 05:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3388d780f41bef64e876ba8a1245f6db_JaffaCakes118.exe

  • Size

    736KB

  • MD5

    3388d780f41bef64e876ba8a1245f6db

  • SHA1

    c0618546061f8517d1a28510c0d70f4f30496b21

  • SHA256

    bf94c8d39f9c022c266397c253747f2432eab395e9aeab2b30be7160939a8762

  • SHA512

    60f96e79693b342be902e4c6e760f1c09024253473f60e0ce828899e88c5387f9423bb5e8fac5e84ab885f04ac88e2b14500044cb40533c8cabf0815c68c2b3b

  • SSDEEP

    12288:2g/coTNTcU3+QSHzdqfBO4U8xj3gNxLk0yjNdQO3tRhpMqqu6V4KFON:7NAHRH4J36

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3388d780f41bef64e876ba8a1245f6db_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3388d780f41bef64e876ba8a1245f6db_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Users\Admin\AppData\Local\Temp\3388d780f41bef64e876ba8a1245f6db_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\3388d780f41bef64e876ba8a1245f6db_JaffaCakes118.exe
      2⤵
      • Suspicious use of UnmapMainImage
      PID:3508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 12
        3⤵
        • Program crash
        PID:1604
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3508 -ip 3508
    1⤵
      PID:4680

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3508-3-0x0000000000400000-0x00000000004C6000-memory.dmp

            Filesize

            792KB

            Download

          • memory/4416-0-0x0000000074702000-0x0000000074703000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4416-1-0x0000000074700000-0x0000000074CB1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4416-2-0x0000000074700000-0x0000000074CB1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4416-5-0x0000000074700000-0x0000000074CB1000-memory.dmp

            Filesize

            5.7MB

            Download