Analysis

  • max time kernel
    25s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-07-2024 22:29

General

  • Target

    5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    5df09d3c24086bbf8de3695b211a9201

  • SHA1

    940de68ea5c6090ae8641da07cbc8e096239f130

  • SHA256

    61443f2fc81caf3eebc3ef503dc69a54986727c90245999cca8dfa590716b478

  • SHA512

    9d9afa8d2722204c13c8474c26943594d96a09e2ee4c6f619632a6c8d72edd0f17cf81488eebbbca32031abb8796e82939ad5d72b8f6a94398470b19ec94ec38

  • SSDEEP

    24576:W+iuVC3C8zgAb4A25KtaDHQ9nA6gXP157RnfDtdj0hCSHK6GmcjqPwTHz:WwVgEK0zunA6gXPD7RLtdj0hVHK6GmcH

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe
      2⤵
        PID:2240

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1324-0-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/1324-1-0x0000000010000000-0x000000001009B000-memory.dmp

      Filesize

      620KB

    • memory/1324-2-0x0000000010000000-0x000000001009B000-memory.dmp

      Filesize

      620KB

    • memory/1324-10-0x0000000010000000-0x000000001009B000-memory.dmp

      Filesize

      620KB

    • memory/2240-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB