f7e77e89d8daa2827cff70941dcaa3192213b267afb0ff97ac8c509c01383e56

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
Size

394KB
MD5

415149f87712e98c341d80e2cd590ae6
SHA1

9f687894ff257cbc84866d30c547498da70522c9
SHA256

f7e77e89d8daa2827cff70941dcaa3192213b267afb0ff97ac8c509c01383e56
SHA512

461323cd082044b5349ba0d6e7863d7c73db353a15b4b196cd3d72de69e83502d71e20365258035e840a80e034658fcf19ebff8ab0560706c48c5c3190e25486
SSDEEP

12288:GXwKAqO0K/lGRgOUqmq9kR6lhKX6y61HnnpHhQMO:GXwD8K/cRgOnmq9g6zySHnnthQMO

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4376 set thread context of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1308	4376	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	85
PID 1308 wrote to memory of 3464	1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	56
PID 1308 wrote to memory of 3464	1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	56
PID 1308 wrote to memory of 3464	1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	56
PID 1308 wrote to memory of 3464	1308	415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\415149f87712e98c341d80e2cd590ae6_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1308-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1308-17-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1308-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3464-24-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3464-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4376-2-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4376-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4376-5-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4376-4-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/4376-12-0x0000000003B60000-0x0000000003B61000-memory.dmp

Filesize
4KB

Download
memory/4376-13-0x0000000003B50000-0x0000000003B51000-memory.dmp

Filesize
4KB

Download
memory/4376-8-0x0000000003B10000-0x0000000003B11000-memory.dmp

Filesize
4KB

Download
memory/4376-6-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4376-7-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/4376-9-0x0000000003B00000-0x0000000003B02000-memory.dmp

Filesize
8KB

Download
memory/4376-21-0x0000000002AB0000-0x0000000002B10000-memory.dmp

Filesize
384KB

Download
memory/4376-20-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4376-3-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4376-1-0x0000000002AB0000-0x0000000002B10000-memory.dmp

Filesize
384KB

Download