f7e77e89d8daa2827cff70941dcaa3192213b267afb0ff97ac8c509c01383e56

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
Size

394KB
MD5

415149f87712e98c341d80e2cd590ae6
SHA1

9f687894ff257cbc84866d30c547498da70522c9
SHA256

f7e77e89d8daa2827cff70941dcaa3192213b267afb0ff97ac8c509c01383e56
SHA512

461323cd082044b5349ba0d6e7863d7c73db353a15b4b196cd3d72de69e83502d71e20365258035e840a80e034658fcf19ebff8ab0560706c48c5c3190e25486
SSDEEP

12288:GXwKAqO0K/lGRgOUqmq9kR6lhKX6y61HnnpHhQMO:GXwD8K/cRgOnmq9g6zySHnnthQMO

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
2508	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2508	3000	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	30
PID 2508 wrote to memory of 1068	2508	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	18
PID 2508 wrote to memory of 1068	2508	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	18
PID 2508 wrote to memory of 1068	2508	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	18
PID 2508 wrote to memory of 1068	2508	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1068
- C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-26-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1068-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2508-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-21-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3000-8-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/3000-19-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/3000-5-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/3000-4-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/3000-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3000-2-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/3000-7-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/3000-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/3000-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/3000-9-0x00000000035C0000-0x00000000035C2000-memory.dmp

Filesize
8KB

Download
memory/3000-12-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/3000-17-0x0000000000340000-0x00000000003A0000-memory.dmp

Filesize
384KB

Download
memory/3000-13-0x0000000003610000-0x0000000003611000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000000340000-0x00000000003A0000-memory.dmp

Filesize
384KB

Download