e709e6d40a47e56750f4c43e119021e9807d82e2b46b9a2fb925c945bd7d8a31

Analysis

max time kernel
136s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
Size

225KB
MD5

61a013f39ea79a22c5fd0bc4c778d36e
SHA1

a4d9bd1d371d591e3108b13e530ed18efa539c3c
SHA256

e709e6d40a47e56750f4c43e119021e9807d82e2b46b9a2fb925c945bd7d8a31
SHA512

03e645fcb3b29aeb939631add17c23149397c049127dc81d2617e12c6d9b4dfe48a26798f94e3192303d9f23916030844945afb5bb1b761f596fba0e572cb1f6
SSDEEP

6144:rr1T53sflPSZWnVW5GJZ2tNYLj8MfstHhjqHT0YLo54j/P:rrralcOVzYKj86stBioY3jH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4688 set thread context of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4688 wrote to memory of 4040	4688	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	85
PID 4040 wrote to memory of 3468	4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	55
PID 4040 wrote to memory of 3468	4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	55
PID 4040 wrote to memory of 3468	4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	55
PID 4040 wrote to memory of 3468	4040	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468
- C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3468-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4040-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4040-67-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4040-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4040-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4040-58-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4688-9-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-46-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/4688-32-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-31-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-30-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-29-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-28-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-5-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-26-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-25-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-24-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-23-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-22-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-21-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-20-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-19-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-17-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-16-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-15-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-14-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-13-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-12-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-11-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-10-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4688-8-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-33-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-7-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-27-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-4-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-3-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-2-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-1-0x00000000022D0000-0x00000000022D3000-memory.dmp

Filesize
12KB

Download
memory/4688-43-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4688-49-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4688-55-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4688-54-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4688-53-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4688-52-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4688-34-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-51-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4688-50-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4688-48-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-47-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-35-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-36-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-6-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4688-45-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/4688-44-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4688-42-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4688-41-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4688-60-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4688-37-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4688-38-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/4688-39-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download