bf2759f6ca74df0bd7f5459648acaa81955fc20598db9bd8aa232416c25a1ffb

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe
Size

392KB
MD5

5fb9e9141801956a7a167ab660446d41
SHA1

07f35e087c15b202433d225cfcd76fc1b877d06f
SHA256

bf2759f6ca74df0bd7f5459648acaa81955fc20598db9bd8aa232416c25a1ffb
SHA512

cea5515b103438c34210e468870c2d173f831bcf00856d45772a6c0a2e108430f01a091d4aae8fbe5fea851e0f1a5853de8226843b8587dbc109180581f11a78
SSDEEP

6144:xKNJpz91PscwD/u+yFeLOaJFPnYttuUkhkA0nVKenxsNoLxFMn90e:S91k7D/uneSakttuVivVpnwnW

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/memory/572-18-0x0000000000400000-0x0000000000427000-memory.dmp	aspack_v212_v242
behavioral1/memory/572-28-0x0000000000400000-0x0000000000427000-memory.dmp	aspack_v212_v242

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	572	WerFault.exe	31

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 2608 wrote to memory of 572	2608	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	31
PID 572 wrote to memory of 2720	572	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	32
PID 572 wrote to memory of 2720	572	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	32
PID 572 wrote to memory of 2720	572	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	32
PID 572 wrote to memory of 2720	572	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 36
    3⤵
    - Program crash
    PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-10-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/572-18-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-28-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/572-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2608-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2608-1-0x0000000000401000-0x0000000000433000-memory.dmp

Filesize
200KB

Download
memory/2608-27-0x0000000000401000-0x0000000000433000-memory.dmp

Filesize
200KB

Download