56608464550743054a9af358f1bb75a2c79f6eb8919a2933dcfb9c02afb3e052

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
Size

318KB
MD5

3bad48ab2692523a80bbde1c1657073f
SHA1

6b73e98b29e7f12d1aa7d9610f03ee9981576cdd
SHA256

56608464550743054a9af358f1bb75a2c79f6eb8919a2933dcfb9c02afb3e052
SHA512

c5c001b3edc6f8440e41c79b3849105803c5bf00cf91114fb8f67ea3884e0a480d77bf2a01130ce1f7366067a833bedf6bf10b28c6b84da29cd42e35e35f9233
SSDEEP

3072:hgnwPtNdVFJxkj33CiDlC49C6BJKjf/RFkyY:h+iQ3NDFA6BJK1FhY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4256-0-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral2/memory/4256-7-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 2916 set thread context of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 4256 wrote to memory of 2916	4256	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	84
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 2916 wrote to memory of 3996	2916	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	86
PID 3996 wrote to memory of 3512	3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	56
PID 3996 wrote to memory of 3512	3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	56
PID 3996 wrote to memory of 3512	3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	56
PID 3996 wrote to memory of 3512	3996	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3512
- C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2916-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2916-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3512-17-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3512-18-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3996-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3996-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3996-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3996-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4256-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4256-7-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download