14761349c650944126db2269c87e71e35b8c3eebed2d242fdeca9e17eba95acf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
Size

780KB
MD5

5f5662406ead58e3ae508ad62c28a6a8
SHA1

0807976501b66af9ab4c3d4f9afc8e0be915cbda
SHA256

14761349c650944126db2269c87e71e35b8c3eebed2d242fdeca9e17eba95acf
SHA512

46e20f1f800146bfb30842af6c322ea126c7a12a6a24532ed15d671866b557d4ce70adc2cc512b2376e2453e143abc6455171321d471d95eeaa6f3443cc1f833
SSDEEP

24576:Qm89gw1ouDgtjUjigHOcUuZ8Gj7qlP+inC/n:mgaXCj7gH2uZ8WqYp/n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
4728	svchost32.exe
3896	svchost32.exe
4972	svchost32.exe
452	svchost32.exe
4864	svchost32.exe
208	svchost32.exe
540	svchost32.exe
2388	svchost32.exe
4064	svchost32.exe
2416	svchost32.exe
4080	svchost32.exe
2720	svchost32.exe
2668	svchost32.exe
1316	svchost32.exe
4876	svchost32.exe
3112	svchost32.exe
4616	svchost32.exe
3760	svchost32.exe
2512	svchost32.exe
2124	svchost32.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File opened for modification	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe
File created	C:\Windows\SysWOW64\svchost32.exe	svchost32.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 4728 set thread context of 3896	4728	svchost32.exe	89
PID 4972 set thread context of 452	4972	svchost32.exe	98
PID 4864 set thread context of 208	4864	svchost32.exe	102
PID 540 set thread context of 2388	540	svchost32.exe	111
PID 4064 set thread context of 2416	4064	svchost32.exe	113
PID 4080 set thread context of 2720	4080	svchost32.exe	116
PID 2668 set thread context of 1316	2668	svchost32.exe	118
PID 4876 set thread context of 3112	4876	svchost32.exe	120
PID 4616 set thread context of 3760	4616	svchost32.exe	122
PID 2512 set thread context of 2124	2512	svchost32.exe	124

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
4728	svchost32.exe
4972	svchost32.exe
4864	svchost32.exe
540	svchost32.exe
4064	svchost32.exe
4080	svchost32.exe
2668	svchost32.exe
4876	svchost32.exe
4616	svchost32.exe
2512	svchost32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 1292 wrote to memory of 3912	1292	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	87
PID 3912 wrote to memory of 4728	3912	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	88
PID 3912 wrote to memory of 4728	3912	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	88
PID 3912 wrote to memory of 4728	3912	5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe	88
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 4728 wrote to memory of 3896	4728	svchost32.exe	89
PID 3896 wrote to memory of 4972	3896	svchost32.exe	97
PID 3896 wrote to memory of 4972	3896	svchost32.exe	97
PID 3896 wrote to memory of 4972	3896	svchost32.exe	97
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 4972 wrote to memory of 452	4972	svchost32.exe	98
PID 452 wrote to memory of 4864	452	svchost32.exe	100
PID 452 wrote to memory of 4864	452	svchost32.exe	100
PID 452 wrote to memory of 4864	452	svchost32.exe	100
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 4864 wrote to memory of 208	4864	svchost32.exe	102
PID 208 wrote to memory of 540	208	svchost32.exe	110
PID 208 wrote to memory of 540	208	svchost32.exe	110
PID 208 wrote to memory of 540	208	svchost32.exe	110
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 540 wrote to memory of 2388	540	svchost32.exe	111
PID 2388 wrote to memory of 4064	2388	svchost32.exe	112
PID 2388 wrote to memory of 4064	2388	svchost32.exe	112
PID 2388 wrote to memory of 4064	2388	svchost32.exe	112
PID 4064 wrote to memory of 2416	4064	svchost32.exe	113
PID 4064 wrote to memory of 2416	4064	svchost32.exe	113
PID 4064 wrote to memory of 2416	4064	svchost32.exe	113
PID 4064 wrote to memory of 2416	4064	svchost32.exe	113

C:\Users\Admin\AppData\Local\Temp\5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\svchost32.exe
    C:\Windows\system32\svchost32.exe 1044 "C:\Users\Admin\AppData\Local\Temp\5f5662406ead58e3ae508ad62c28a6a8_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\svchost32.exe
      C:\Windows\SysWOW64\svchost32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1148 "C:\Windows\SysWOW64\svchost32.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4972
      - C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2416
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4080
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2720
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1316
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4876
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1124 "C:\Windows\SysWOW64\svchost32.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4616
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3760
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\system32\svchost32.exe 1120 "C:\Windows\SysWOW64\svchost32.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2512
        
        C:\Windows\SysWOW64\svchost32.exe
        
        C:\Windows\SysWOW64\svchost32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost32.exe

Filesize
780KB

MD5
5f5662406ead58e3ae508ad62c28a6a8

SHA1
0807976501b66af9ab4c3d4f9afc8e0be915cbda

SHA256
14761349c650944126db2269c87e71e35b8c3eebed2d242fdeca9e17eba95acf

SHA512
46e20f1f800146bfb30842af6c322ea126c7a12a6a24532ed15d671866b557d4ce70adc2cc512b2376e2453e143abc6455171321d471d95eeaa6f3443cc1f833

Download Submit
memory/208-45-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/208-41-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/208-40-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/452-31-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/452-37-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/452-32-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1316-81-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1316-77-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1316-76-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2124-103-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2388-50-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2388-49-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2388-54-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2416-58-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2416-63-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2416-59-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2720-72-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2720-68-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2720-67-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3112-86-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3112-85-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3112-90-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3760-99-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3760-95-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3760-94-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3896-28-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3896-22-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3896-19-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3896-20-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3896-21-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3912-4-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3912-5-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3912-16-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3912-2-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3912-3-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download