784e55d28aac623b2b7b3557c3b9cbe38b3125593b96389729142bd854e6990d

Analysis

max time kernel
92s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
Size

188KB
MD5

366575fbdc2eb6d9b3f6dd83c9a17a05
SHA1

0c79dd6d06f9d2bda66e8aa8067ea0707989c971
SHA256

784e55d28aac623b2b7b3557c3b9cbe38b3125593b96389729142bd854e6990d
SHA512

1a7b4bc05ad3bb6558f02d6ed8d139b3f89df996dad4196d3e611256c214406d2fb56bfb154d6470669608803abc662cbc64699ebfefb25c1ee15a3c0d3b2987
SSDEEP

3072:GynFI0r1lTtmFwj/JqtVLaiJ2UI3Bdb9xKLf+eAVzjKgnrWjrNvb3OpKIZJ8Ft4C:F5r1lTtmulqtJako9xguh2grArNtI42O

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

description	pid	process	target process
PID 1680 set thread context of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 set thread context of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1680 366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

pid process

4948 366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

pid	process
4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Local\Temp\366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948

C:\Users\Admin\AppData\Local\Temp\366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe"
3⤵
PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x0000000075132000-0x0000000075133000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/1680-2-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/1680-9-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/4880-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4880-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4880-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4880-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4948-3-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4948-6-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4948-14-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download

description	pid	process	target process
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 1680 wrote to memory of 4948	1680	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe
PID 4948 wrote to memory of 4880	4948	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe	366575fbdc2eb6d9b3f6dd83c9a17a05_JaffaCakes118.exe