53072ff0b15956bde023ff3f38d6bc6dc1f804c8840583bab9700724d7ce3f9c

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
Size

316KB
MD5

65dc16213a81c6e15d7becb20756d40e
SHA1

d2eb034e79da0c3395107e667b2ae2c7d3e6923b
SHA256

53072ff0b15956bde023ff3f38d6bc6dc1f804c8840583bab9700724d7ce3f9c
SHA512

9a5d9a1b4229dba25e09f7da1b1b54879e0a6d986a8de6802ccbdd8bc75b5701d720b8e4a0f72f5c9c3663c89c88d1399f09434f82ec4d1d4690f7e4a207eb8f
SSDEEP

6144:6sGTsoNQlHv4GJpU0lCbfWmyGZ8nVW5GJZ2tNYLj8MfsFqPHnOff:RGTg1lJpU0TGWVzYKj86sFIHg

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2436	3020	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	84
PID 2436 wrote to memory of 3440	2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	56
PID 2436 wrote to memory of 3440	2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	56
PID 2436 wrote to memory of 3440	2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	56
PID 2436 wrote to memory of 3440	2436	65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3440
- C:\Users\Admin\AppData\Local\Temp\65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65dc16213a81c6e15d7becb20756d40e_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-45-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2436-53-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2436-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3020-4-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-25-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-24-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-23-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-22-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-21-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-20-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-19-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-18-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-17-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-16-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-15-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-11-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-14-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-13-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-10-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-9-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-7-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-6-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-5-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-0-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/3020-26-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/3020-3-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-28-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3020-30-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3020-44-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-43-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/3020-42-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3020-41-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/3020-40-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/3020-39-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/3020-38-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/3020-37-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/3020-36-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-35-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3020-34-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/3020-33-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3020-32-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/3020-31-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/3020-8-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3020-2-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3020-48-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/3020-1-0x0000000002340000-0x0000000002344000-memory.dmp

Filesize
16KB

Download
memory/3440-49-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download