7c56d484bc9b17c99fc5e73cd4e7afb2e369b98b417fe6529723412d42652287

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
Size

295KB
MD5

341c6581f0b631c66f75a756bc2bd2de
SHA1

fda68605c7f125a9c11d32df16979858244bd698
SHA256

7c56d484bc9b17c99fc5e73cd4e7afb2e369b98b417fe6529723412d42652287
SHA512

021eeefffe6eb8f1eb140dcbd54c3d76c5f5ab08553aa8f0686f20115b43f900024eda503f3f4dfcb804aa93e554b60b6aabf4a9f7be4a3b16b7779ad2d981a3
SSDEEP

6144:K/ZczXW1y/hB4odV0qy6MahnUipcALXeSXNaq8+k4ISB1U:GGsEBT0qy6MSeAuUNa+I+1U

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3432 set thread context of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 4072 set thread context of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 3432 wrote to memory of 4072	3432	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	85
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 4072 wrote to memory of 3516	4072	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	86
PID 3516 wrote to memory of 3460	3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	56
PID 3516 wrote to memory of 3460	3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	56
PID 3516 wrote to memory of 3460	3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	56
PID 3516 wrote to memory of 3460	3516	341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Users\Admin\AppData\Local\Temp\341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\341c6581f0b631c66f75a756bc2bd2de_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-4-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/3460-16-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3460-17-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3516-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3516-12-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3516-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4072-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4072-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4072-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download