e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe
Size 253KB
Sample240330-mldhasea53
SHA256 e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
MD5 3a5c5bb43232e4e48b63cdf123dec876
SHA1 95b478c57de28b87d6bd87dd32a4faec02b0d620
SHA512 59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281
SSDEEP 3072:wBynOpL12riocLMjve4LOk2AcxISCGn2rc2gGw7cMC9oyZ9rUoyBz92bO511D0tv:wBlL/c/LOk2Ac3CGn2cb1n5LD0t2lDy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1072	3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	1072	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 3796	1072	3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe	87
PID 1072 wrote to memory of 3796	1072	3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe	87
PID 1072 wrote to memory of 3796	1072	3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118.exe"
  2⤵
  PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 964
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1072 -ip 1072
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ylbzgkuxqsi.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4046.tmp\ylbzgkuxqsi.dll
Size 31KB
SHA256 23e80d01cf007b17f91366fb1866568f0385ff08767434728f209535d3452fdd
MD5 51d6f1227b9a2e0b090c9d0dab9d4528
SHA1 43149a31386cd9613c5b0e8a218f1e7cc7f77af8
SHA512 b85fd793d0ddf2e96833b458fee64008ff13a863a4b9ba044bf916efc41947fdadc13cfb1deaa151d58c162d706e32226e14ea2a7ba82557eccff329c9e38afb
SSDEEP 768:ovoaaC/7aXedJGhoDJLpKQmZuu82bkBYQo/LukLt3KWA:ovoaaC/76eHGhippKQmZuu1wBYBLRJKX
MD5 SHA1 SHA512 SSDEEP

Submit Download