8182de111066839d2a1bc29f69b7a280674df1dc5db613a8438542299bd455f8

Analysis

max time kernel
136s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
Size

388KB
MD5

59f42fa7b6e20b97bc25cdd294d62d53
SHA1

a720bc7c6b889c8d85b0bc5ba9dbf4c115e196be
SHA256

8182de111066839d2a1bc29f69b7a280674df1dc5db613a8438542299bd455f8
SHA512

d656e152b64cb258320daabf43f4331137679751ff1507b2c4b4116c6689c8a13a54be602d49388b8b5163070917afbc4099333275ae2af33e7165f289d3c85a
SSDEEP

12288:fyaEI2HLLzrjsofJlUNH1ANzNSVzYKj86sdJov:fYI2YOJlU5CIpYOMJov

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 524 set thread context of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 524 wrote to memory of 3324	524	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	94
PID 3324 wrote to memory of 3424	3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	56
PID 3324 wrote to memory of 3424	3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	56
PID 3324 wrote to memory of 3424	3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	56
PID 3324 wrote to memory of 3424	3324	59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Users\Admin\AppData\Local\Temp\59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\59f42fa7b6e20b97bc25cdd294d62d53_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-0-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/524-5-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-46-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-45-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-44-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-43-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/524-42-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-41-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-40-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-39-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-38-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-37-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-36-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-35-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-34-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-33-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-32-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-31-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-30-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-29-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-28-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-27-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-26-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-25-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-24-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-23-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-22-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-21-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-20-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-19-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-18-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-17-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-16-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-15-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-14-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-13-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-12-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-11-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/524-10-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-9-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-8-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-7-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-6-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-4-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-3-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-2-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-1-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/524-47-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/524-48-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/524-51-0x0000000000401000-0x000000000048F000-memory.dmp

Filesize
568KB

Download
memory/524-57-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/3324-52-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3324-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3324-55-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3324-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3424-58-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3424-59-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download