c4d5411821f147ecc09de86f898a3e276a9dfd57cbc3bc18d7355626f1b074a3

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2473030215b82183fc0673dd30990feb_JaffaCakes118.exe
Size

2.1MB
MD5

2473030215b82183fc0673dd30990feb
SHA1

b6adb394d7bc4635f56e9f0dc12cc2a93f6cb2b9
SHA256

c4d5411821f147ecc09de86f898a3e276a9dfd57cbc3bc18d7355626f1b074a3
SHA512

b102f5db54fa059590920d82a840449a9762a533db58cd4e19880ef6bb153879fa3a1bac57d2884874f61b97b9ef4b0d666cef914822f6c8af04ece59c1e746b
SSDEEP

49152:e4juCeSwsWapt1sec1L3HEcvfCCL20UmVl+G:e4j8SwQctZCCLcmj+G

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	2892	WerFault.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	2473030215b82183fc0673dd30990feb_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	2473030215b82183fc0673dd30990feb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1428	2892	2473030215b82183fc0673dd30990feb_JaffaCakes118.exe	30
PID 2892 wrote to memory of 1428	2892	2473030215b82183fc0673dd30990feb_JaffaCakes118.exe	30
PID 2892 wrote to memory of 1428	2892	2473030215b82183fc0673dd30990feb_JaffaCakes118.exe	30
PID 2892 wrote to memory of 1428	2892	2473030215b82183fc0673dd30990feb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2473030215b82183fc0673dd30990feb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2473030215b82183fc0673dd30990feb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 912
  2⤵
  - Program crash
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2892-1-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2892-2-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/2892-3-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/2892-4-0x0000000000400000-0x00000000006FA000-memory.dmp

Filesize
3.0MB

Download
memory/2892-5-0x0000000000400000-0x00000000006FA000-memory.dmp

Filesize
3.0MB

Download
memory/2892-6-0x0000000000400000-0x00000000006FA000-memory.dmp

Filesize
3.0MB

Download
memory/2892-7-0x0000000000400000-0x00000000006FA000-memory.dmp

Filesize
3.0MB

Download
memory/2892-8-0x0000000000400000-0x00000000006FA000-memory.dmp

Filesize
3.0MB

Download