Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22-07-2024 09:54
General
-
Target
62c16a595f196bfc2336e15edc5d0e86_JaffaCakes118.exe
-
Size
141KB
-
MD5
62c16a595f196bfc2336e15edc5d0e86
-
SHA1
0f73fa83e042f7bf5ef9e286da41c3bd3f1ad71e
-
SHA256
eae37d0100900c2db5054a08757b1f0feb815d27d102cc0d1977f5693c95bc9b
-
SHA512
26fe07761cf25c159881ab0d0198f512f2bf6f0e137f7a507578c452ee1cb14a26fd944ebbe8b9d698e9a601938a2c2e153f12279034a4be86e62a54fa974e15
-
SSDEEP
3072:rp+QaqpgRZV40sITxwlBlHcYDJBRhKZUI06RcfXkVYEvlF3OdbAF+Q4TR7hWZIs1:rp+QJ0ZaaWDz/rKZUI0QCREf3O/5TR78
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62c16a595f196bfc2336e15edc5d0e86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\62c16a595f196bfc2336e15edc5d0e86_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 5642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4844 -ip 48441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
100KB
-
Filesize
188KB
-
Filesize
100KB
-
Filesize
100KB