Analysis

  • max time kernel
    94s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2024 00:54

General

  • Target

    ce48912de9d6a4937d00172312315403_JaffaCakes118.exe

  • Size

    743KB

  • MD5

    ce48912de9d6a4937d00172312315403

  • SHA1

    561705750cb824403f2b03dfc307ae2b646f7b3d

  • SHA256

    bb91aad6bed9930c76c55bba6a1856fd89a86af069a0040e31601e91fa5f8a2e

  • SHA512

    5b8f4ba79e77a2650e16c7e527b7f31f91dafcc6b381eac28eff4fb61b9112fbb1841e4f07e20e044cec011b239beeb0de72f151233fbd83793195dccabdaf36

  • SSDEEP

    12288:8CgZ1bgCkfoFwa0szEAE4COMa+XV+UfaAK/lGRgOUqmq9kR6lhKXRae/flS/riHl:DU+lfoFwhiEAC4SVPaAK/cRgOnmq9g6Y

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3404
      • C:\Users\Admin\AppData\Local\Temp\ce48912de9d6a4937d00172312315403_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ce48912de9d6a4937d00172312315403_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Users\Admin\AppData\Local\Temp\ce48912de9d6a4937d00172312315403_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\ce48912de9d6a4937d00172312315403_JaffaCakes118.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5040

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1780-0-0x0000000000400000-0x00000000004EB000-memory.dmp

      Filesize

      940KB

    • memory/1780-1-0x0000000002280000-0x00000000022E0000-memory.dmp

      Filesize

      384KB

    • memory/1780-2-0x0000000002480000-0x0000000002481000-memory.dmp

      Filesize

      4KB

    • memory/1780-72-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-71-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-70-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-69-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-68-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-67-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-66-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-65-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-64-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-63-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-62-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-61-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-60-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-59-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-58-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-57-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-56-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-55-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-54-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-53-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-52-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-51-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-50-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-49-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-48-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-47-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-46-0x00000000033A0000-0x00000000033BB000-memory.dmp

      Filesize

      108KB

    • memory/1780-45-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-44-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-43-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-42-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-41-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-40-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-39-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-38-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-37-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-36-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-35-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-34-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-33-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-32-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-31-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-30-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-29-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-28-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-27-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-26-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-25-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-24-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-23-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-22-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-21-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-20-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-19-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-18-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-17-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-16-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-15-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-14-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-13-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-12-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-11-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-10-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-9-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-8-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1780-7-0x00000000024F0000-0x00000000024F1000-memory.dmp

      Filesize

      4KB

    • memory/1780-6-0x0000000002460000-0x0000000002461000-memory.dmp

      Filesize

      4KB

    • memory/1780-5-0x00000000024A0000-0x00000000024A1000-memory.dmp

      Filesize

      4KB

    • memory/1780-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

      Filesize

      4KB

    • memory/1780-3-0x0000000002470000-0x0000000002471000-memory.dmp

      Filesize

      4KB

    • memory/1780-80-0x0000000002280000-0x00000000022E0000-memory.dmp

      Filesize

      384KB

    • memory/1780-79-0x0000000000400000-0x00000000004EB000-memory.dmp

      Filesize

      940KB

    • memory/3404-82-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/5040-76-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/5040-75-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/5040-77-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB