Analysis

  • max time kernel
    140s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 22:29

General

  • Target

    5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    5df09d3c24086bbf8de3695b211a9201

  • SHA1

    940de68ea5c6090ae8641da07cbc8e096239f130

  • SHA256

    61443f2fc81caf3eebc3ef503dc69a54986727c90245999cca8dfa590716b478

  • SHA512

    9d9afa8d2722204c13c8474c26943594d96a09e2ee4c6f619632a6c8d72edd0f17cf81488eebbbca32031abb8796e82939ad5d72b8f6a94398470b19ec94ec38

  • SSDEEP

    24576:W+iuVC3C8zgAb4A25KtaDHQ9nA6gXP157RnfDtdj0hCSHK6GmcjqPwTHz:WwVgEK0zunA6gXPD7RLtdj0hVHK6GmcH

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\5df09d3c24086bbf8de3695b211a9201_JaffaCakes118.exe
      2⤵
        PID:868
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 76
          3⤵
          • Program crash
          PID:4608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 868 -ip 868
      1⤵
        PID:1844

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1640-0-0x00000000021A0000-0x00000000021A1000-memory.dmp

        Filesize

        4KB

      • memory/1640-1-0x0000000010000000-0x000000001009B000-memory.dmp

        Filesize

        620KB

      • memory/1640-2-0x0000000010000000-0x000000001009B000-memory.dmp

        Filesize

        620KB

      • memory/1640-3-0x00000000021A0000-0x00000000021A1000-memory.dmp

        Filesize

        4KB

      • memory/1640-6-0x0000000010000000-0x000000001009B000-memory.dmp

        Filesize

        620KB