8acad0bb89c55778552e31fa5ac83b74316d51439178b3ac27fc87b5134fee96

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe
Size

123KB
MD5

5b607e6fd148c8086693efbdeeb41b78
SHA1

361dc32bd92df7af01d6ff94f217aee59fcea01e
SHA256

8acad0bb89c55778552e31fa5ac83b74316d51439178b3ac27fc87b5134fee96
SHA512

73f2b71d38808e892c867d35f74b1e30187fc4c06589f3ab5cad850c80b359636b0334d61b583d6d97d5265a746d88ced96a3ba0c82f7d1376d4f1995e6e1474
SSDEEP

1536:VWKV3DPDeoGfC9OIyxHgPqjqh8YR2ah7WL4WGDbKeevF4PT0Zonee8joV:VWKVLDFGKKqhLR2Y7WyevF47BnR8A

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
4980	msnmsgr.exe
4204	msnmsgr.exe
1504	msnmsgr.exe
4504	msnmsgr.exe
1580	msnmsgr.exe
4260	msnmsgr.exe
4600	msnmsgr.exe
4712	msnmsgr.exe
228	msnmsgr.exe
628	msnmsgr.exe
640	msnmsgr.exe
3364	msnmsgr.exe
4336	msnmsgr.exe
2204	msnmsgr.exe
2664	msnmsgr.exe
228	msnmsgr.exe
2444	msnmsgr.exe
3060	msnmsgr.exe
3656	msnmsgr.exe
4792	msnmsgr.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File created	C:\Windows\SysWOW64\msnmsgr.exe	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgr.exe	msnmsgr.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 4980 set thread context of 4204	4980	msnmsgr.exe	87
PID 1504 set thread context of 4504	1504	msnmsgr.exe	98
PID 1580 set thread context of 4260	1580	msnmsgr.exe	101
PID 4600 set thread context of 4712	4600	msnmsgr.exe	105
PID 228 set thread context of 628	228	msnmsgr.exe	107
PID 640 set thread context of 3364	640	msnmsgr.exe	111
PID 4336 set thread context of 2204	4336	msnmsgr.exe	113
PID 2664 set thread context of 228	2664	msnmsgr.exe	123
PID 2444 set thread context of 3060	2444	msnmsgr.exe	125
PID 3656 set thread context of 4792	3656	msnmsgr.exe	127

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 3936 wrote to memory of 1004	3936	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	84
PID 1004 wrote to memory of 4980	1004	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	86
PID 1004 wrote to memory of 4980	1004	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	86
PID 1004 wrote to memory of 4980	1004	5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe	86
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4980 wrote to memory of 4204	4980	msnmsgr.exe	87
PID 4204 wrote to memory of 1504	4204	msnmsgr.exe	97
PID 4204 wrote to memory of 1504	4204	msnmsgr.exe	97
PID 4204 wrote to memory of 1504	4204	msnmsgr.exe	97
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 1504 wrote to memory of 4504	1504	msnmsgr.exe	98
PID 4504 wrote to memory of 1580	4504	msnmsgr.exe	100
PID 4504 wrote to memory of 1580	4504	msnmsgr.exe	100
PID 4504 wrote to memory of 1580	4504	msnmsgr.exe	100
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 1580 wrote to memory of 4260	1580	msnmsgr.exe	101
PID 4260 wrote to memory of 4600	4260	msnmsgr.exe	104
PID 4260 wrote to memory of 4600	4260	msnmsgr.exe	104
PID 4260 wrote to memory of 4600	4260	msnmsgr.exe	104
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4600 wrote to memory of 4712	4600	msnmsgr.exe	105
PID 4712 wrote to memory of 228	4712	msnmsgr.exe	106
PID 4712 wrote to memory of 228	4712	msnmsgr.exe	106
PID 4712 wrote to memory of 228	4712	msnmsgr.exe	106
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 228 wrote to memory of 628	228	msnmsgr.exe	107
PID 628 wrote to memory of 640	628	msnmsgr.exe	110

C:\Users\Admin\AppData\Local\Temp\5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\SysWOW64\msnmsgr.exe
    C:\Windows\system32\msnmsgr.exe 984 "C:\Users\Admin\AppData\Local\Temp\5b607e6fd148c8086693efbdeeb41b78_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\SysWOW64\msnmsgr.exe
      C:\Windows\SysWOW64\msnmsgr.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1140 "C:\Windows\SysWOW64\msnmsgr.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1504
      - C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1104 "C:\Windows\SysWOW64\msnmsgr.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1104 "C:\Windows\SysWOW64\msnmsgr.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1100 "C:\Windows\SysWOW64\msnmsgr.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1108 "C:\Windows\SysWOW64\msnmsgr.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:640
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3364
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1104 "C:\Windows\SysWOW64\msnmsgr.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4336
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1104 "C:\Windows\SysWOW64\msnmsgr.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2664
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1104 "C:\Windows\SysWOW64\msnmsgr.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2444
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3060
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\system32\msnmsgr.exe 1108 "C:\Windows\SysWOW64\msnmsgr.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3656
        
        C:\Windows\SysWOW64\msnmsgr.exe
        
        C:\Windows\SysWOW64\msnmsgr.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msnmsgr.exe

Filesize
123KB

MD5
5b607e6fd148c8086693efbdeeb41b78

SHA1
361dc32bd92df7af01d6ff94f217aee59fcea01e

SHA256
8acad0bb89c55778552e31fa5ac83b74316d51439178b3ac27fc87b5134fee96

SHA512
73f2b71d38808e892c867d35f74b1e30187fc4c06589f3ab5cad850c80b359636b0334d61b583d6d97d5265a746d88ced96a3ba0c82f7d1376d4f1995e6e1474

Download Submit
memory/228-69-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/628-48-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1004-2-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1004-3-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1004-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1004-17-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2204-62-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3060-76-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3364-55-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4204-14-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4204-18-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4260-34-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4504-27-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4504-24-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4712-41-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4792-83-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads