612a346d3e2412113c53343b67419bc7a13bcf1bfe890137b68b3b5553a20096

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe
Size 423KB
Sample240330-jms3labc5y
SHA256 612a346d3e2412113c53343b67419bc7a13bcf1bfe890137b68b3b5553a20096
MD5 3737a705b553c9a6245722aa948a2beb
SHA1 b6a2abfaaffbb3560dc9ebae6f3bd14aa0594b44
SHA512 401c211911ab46dfe85c015e2aa9c469f5486457f980c5eea4bf5e27ca74d13069c74ff9844cfd2d755e6ca44997e1ad49655bd8d383366ab40ed48e709ef22a
SSDEEP 6144:VBlL/ideqEZ6AVoZcSJGr9TB0PvQqlKxOwCOnPj+p9sHRBNmoJke6:DRvrVpovkEQnPip6HdMP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1960	3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	1960	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4532	1960	3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe	89
PID 1960 wrote to memory of 4532	1960	3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe	89
PID 1960 wrote to memory of 4532	1960	3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb_JaffaCakes118.exe"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 1028
  2⤵
  - Program crash
  PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1960 -ip 1960
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wxmkcb.dll

Path C:\Users\Admin\AppData\Local\Temp\nst3598.tmp\wxmkcb.dll
Size 30KB
SHA256 b31b5199366598aa7e035d334e1f045b79902aedb13186f8ba178f9cc8d7b49a
MD5 0c830a1bd50b239167ea8a7bdd68e095
SHA1 e65f3280c817f0f7e52a52112121d17ffcbc7e5d
SHA512 c81ced34a906cfcd2e79466a0cbed7bcca3d5d830dcb5b710d45ea2d572d19763bd7721c55368e80a015e716f47e0fe8f45acf30d8e8e24e9d4c0e3d00dffa17
SSDEEP 768:SSFszi/seKQIcgu2VUMyPx470ahDw+GTN:mzl9QIcgu2v2ah9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1960-6-0x00000000751E0000-0x00000000751EB000-memory.dmp

Download

memory/1960-9-0x00000000751E0000-0x00000000751EB000-memory.dmp