Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 17:51

General

  • Target

    642e28bc04edc3f3995bd6676446cb47_JaffaCakes118.exe

  • Size

    80KB

  • MD5

    642e28bc04edc3f3995bd6676446cb47

  • SHA1

    5a73e75615b4584f2645c77258926004b561ee41

  • SHA256

    af77b36434a160127c6e0d15d9bb988264487a91e8b001457c1f02ed17923dde

  • SHA512

    023ef31bae16619596fd7072c448e3a610a6a2ce0c6ef2d6876230a09f9c6d3b85167a135f653223f302b523e8e8a11024871e60113e589abe1eb44285f28f8b

  • SSDEEP

    1536:raBFzfjt/nnwFNWnn89RKMcnXPk6u5WXYwfVs/3VsivHxJmdaAUk0EYfGa:mXzfB/nnGNWnn8nKM4s6uQY/msuwAy7f

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\642e28bc04edc3f3995bd6676446cb47_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\642e28bc04edc3f3995bd6676446cb47_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\642e28bc04edc3f3995bd6676446cb47_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\642e28bc04edc3f3995bd6676446cb47_JaffaCakes118.exe
      2⤵
        PID:2208

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1780-0-0x0000000074DF1000-0x0000000074DF2000-memory.dmp

      Filesize

      4KB

    • memory/1780-1-0x0000000074DF0000-0x000000007539B000-memory.dmp

      Filesize

      5.7MB

    • memory/1780-11-0x0000000074DF0000-0x000000007539B000-memory.dmp

      Filesize

      5.7MB

    • memory/1780-16-0x0000000074DF0000-0x000000007539B000-memory.dmp

      Filesize

      5.7MB

    • memory/2208-10-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/2208-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2208-6-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/2208-4-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/2208-2-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB