90aea5afb79d4a06dd87604c0e77067079fe149ba7d9c6db2308b64d7ad4d641

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe
Size 241KB
Sample240401-2lr31shf89
SHA256 90aea5afb79d4a06dd87604c0e77067079fe149ba7d9c6db2308b64d7ad4d641
MD5 7c55e395258e9e69d10502500d443ae0
SHA1 e5cec42fec04f09cc8bac8d336063430a3ac023e
SHA512 18c925b4b5a0844ff23ebee9f057fc5b5685117bc7e62dfc8bd38f7dedc915e01641a8da6c968381e041a0354b475d25ae0edc3b1b76a2ce2d1f2c8d02ef6c63
SSDEEP 6144:wBlL/coLuNGYmoF45DsR65CGB5zCWONsqRJrjFUcl5+5:CexGYLF4S09UbrKcA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3364	7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4900	3364	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4752	3364	7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe	84
PID 3364 wrote to memory of 4752	3364	7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe	84
PID 3364 wrote to memory of 4752	3364	7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7c55e395258e9e69d10502500d443ae0_JaffaCakes118.exe"
  2⤵
  PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 1060
  2⤵
  - Program crash
  PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3364 -ip 3364
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zkyayjffrdi.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa53AF.tmp\zkyayjffrdi.dll
Size 31KB
SHA256 1fdc9ecfa8bddd5c3d7b77913cec4dba53263dac5b8f35cde40e920a58f2deca
MD5 5850eabb38f5b0d1922054acd9b9f2c2
SHA1 be60273f8322a4bf9fc6751c7c524a6b03822f50
SHA512 cbafa1d03004a692851c1d9306e9c08d43d34f36f10d7c084d308e41e7c38a1774bc674ff6a230a5dd905b2dad91703f52c974fed42f0ebae179af05b257f885
SSDEEP 768:WkJszi/0uyQzByH82eZ/lJlFm12nL7w0Tt:Ezd1QzBU82eZ9U10
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3364-6-0x0000000074860000-0x000000007486B000-memory.dmp

Download

memory/3364-9-0x0000000074860000-0x000000007486B000-memory.dmp