bf45dedf03288636a2674b70d3fd42ee69cdcdfb4c7351e7ef972fb41465a90f

Analysis

max time kernel
94s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
Size

911KB
MD5

d07687c1ad211e9b05d1fddf8a093cab
SHA1

c5f0ad91e998d41e79b6e54a9f868c641076007e
SHA256

bf45dedf03288636a2674b70d3fd42ee69cdcdfb4c7351e7ef972fb41465a90f
SHA512

5287164700a1676bcdf69536a94707d370487956fc1aeb9c47a81d0b8ce590708419d8d87940a564190264b561fb4757bd941f2e7f271514176dbccdc55cded6
SSDEEP

24576:Qg3UqSjMikbvWd88NatBgCbEuo276MKsQ31dW:UqSjNi+bsfVbEuo27+j31dW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 4892 set thread context of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
Token: SeDebugPrivilege	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
Token: SeDebugPrivilege	3852	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1036	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	82
PID 1884 wrote to memory of 1036	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	82
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 1884 wrote to memory of 4892	1884	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	83
PID 4892 wrote to memory of 764	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	84
PID 4892 wrote to memory of 764	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	84
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3852	4892	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	85
PID 3852 wrote to memory of 2508	3852	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	86
PID 3852 wrote to memory of 2508	3852	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	86
PID 3852 wrote to memory of 3740	3852	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	87
PID 3852 wrote to memory of 3740	3852	d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
  2⤵
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
      4⤵
      PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe
      4⤵
      PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\d07687c1ad211e9b05d1fddf8a093cab_JaffaCakes118.exe.log

Filesize
224B

MD5
1e4f2a29e11dead55e61329942cd2b14

SHA1
4b3ec9b98797d2f734d67b47cc149546f21cf0af

SHA256
28bbb0da12bd69adc9df324c01392655b788115aba7466f02c23e1ba09f789d4

SHA512
2e28227d898486bfe1cea081df486464b214df50500786e30d6ee9e7d6391f3aacd2f1ed1d0eab60d518bbc79f20f32c226f00ffd70abfe9af45a746cb08416c

Download Submit
memory/1884-8-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/1884-1-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/1884-3-0x00000000015C0000-0x00000000015C8000-memory.dmp

Filesize
32KB

Download
memory/1884-4-0x000000001BDB0000-0x000000001BE56000-memory.dmp

Filesize
664KB

Download
memory/1884-6-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/1884-0-0x00007FFBFB455000-0x00007FFBFB456000-memory.dmp

Filesize
4KB

Download
memory/1884-2-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/3852-13-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/3852-14-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/3852-15-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/3852-16-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/4892-10-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/4892-12-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/4892-7-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download
memory/4892-11-0x00007FFBFB1A0000-0x00007FFBFBB41000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads