f928b74b982e16d39df103d29a467f9a3a6515d9b14b3dcbd45ff412d5985c7c

Analysis

max time kernel
142s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
Size

288KB
MD5

63846950d8e55fb7d81e6ef23d6cc17c
SHA1

644b9cc3fb8e1c434f1136bc7cb5ba3dafd32ad3
SHA256

f928b74b982e16d39df103d29a467f9a3a6515d9b14b3dcbd45ff412d5985c7c
SHA512

8f3fa62a7196d6ad638922fb610f6c717a259df5a8f3a494b92bea0bacc3a68f7542cb900e2453c4016fa695d0f5fe9f410235723d9bf5ded8ae05a68f1e82d7
SSDEEP

6144:lWEOHkBrrBg8pnmQwKTS8eGXZzI3zbywe8Pl+GIZ:lWEOHkk8IQK85ql9GZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3592-4-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3592-9-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3592-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3592-20-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 940 set thread context of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 3592 set thread context of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 940 wrote to memory of 3592	940	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	85
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 3592 wrote to memory of 2632	3592	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	87
PID 2632 wrote to memory of 3508	2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	56
PID 2632 wrote to memory of 3508	2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	56
PID 2632 wrote to memory of 3508	2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	56
PID 2632 wrote to memory of 3508	2632	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-1-0x0000000000401000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/940-0-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/940-13-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2632-26-0x00000000004E0000-0x00000000005A9000-memory.dmp

Filesize
804KB

Download
memory/2632-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2632-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2632-17-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3508-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3508-23-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3592-9-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3592-20-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3592-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3592-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download