Analysis

  • max time kernel
    95s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-07-2024 09:34

General

  • Target

    3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe

  • Size

    87KB

  • MD5

    3cd7c86af5fe368c3add0b9d55034060

  • SHA1

    b1f33ced39f0acb09486651e92a2cb8cda0543d4

  • SHA256

    48f6f4c9a2bc44617ccd95e7362b1fcfd75b3fed8162d28727c7f0da2edc0300

  • SHA512

    a46cd7ce505dbce2ac2e75956861c826065d0be682036e370b4d93afd1ffd48eef3b67432d1cbc2084b68ff82bd6bf3d2273e13bb96e7840dd7a2e501283c273

  • SSDEEP

    1536:Kvm14+EEZdVvF59CwWs2BsUUPvYXNd1UDIE3FwR+X9:HtHZHL9JWeUUPvYXH1UDIE3/

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\Users\Admin\AppData\Local\Temp\3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
          3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
          3⤵
            PID:4496
          • C:\Users\Admin\AppData\Local\Temp\3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
            3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4480

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3392-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

        Filesize

        28KB

      • memory/3392-9-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

        Filesize

        4KB

      • memory/3416-0-0x0000000074E12000-0x0000000074E13000-memory.dmp

        Filesize

        4KB

      • memory/3416-1-0x0000000074E10000-0x00000000753C1000-memory.dmp

        Filesize

        5.7MB

      • memory/3416-6-0x0000000074E10000-0x00000000753C1000-memory.dmp

        Filesize

        5.7MB

      • memory/4480-2-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

      • memory/4480-5-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

      • memory/4480-8-0x0000000074B20000-0x0000000075128000-memory.dmp

        Filesize

        6.0MB

      • memory/4480-12-0x0000000074B20000-0x0000000075128000-memory.dmp

        Filesize

        6.0MB