662b44a7fd7d5d5042c05dd3e049e52844d613febdde0ee9dd96d50a3ac55513

Analysis

max time kernel
91s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe
Size 245KB
Sample240401-d6hhbach93
SHA256 662b44a7fd7d5d5042c05dd3e049e52844d613febdde0ee9dd96d50a3ac55513
MD5 66a64f84f91c1dd2bc4b9f01faf15d40
SHA1 21812f5c0a37e7b479f1dcc63237d0070e04c076
SHA512 08b4fe874cc4cf0cc70a501e92a55a66396918197cf718b1ae632b223d899b56f0132925314cfadacb2f08f373559df331bd223257a792cb656fbcefec783380
SSDEEP 6144:wBlL/ch4YPNYPUL6BM+WUT71/+F9XZHoN1zELbMeVD5Zc+B0I6:Ceh4GN8RM+j0za1gPxVD5FB0b
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4044	66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3984	4044	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4864	4044	66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe	87
PID 4044 wrote to memory of 4864	4044	66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe	87
PID 4044 wrote to memory of 4864	4044	66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118.exe"
  2⤵
  PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 988
  2⤵
  - Program crash
  PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4044 -ip 4044
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

atzfnwlbz.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4F3A.tmp\atzfnwlbz.dll
Size 43KB
SHA256 649545c1a63dc5397987051b5d2a345fcb87bbf7ea8cfc1e15f668f0c3f5bb18
MD5 b19970ad6a9300060d8b0f43cb4de34a
SHA1 60e4629ed93e58eb0e894a23254028353aaa71ae
SHA512 4eddef779ceea9abe92be5a9cf151709c89e3cae92dc916bdd075deb0df3f430950f8183a6a45730c9e1c16838673474b79e233c54cd13fe23495d2f5210d864
SSDEEP 768:E6tefip4O73Qet5EdYkyHgrm+ukNO9yyjYsUAPH4IEt:E6teqpB7gDYvTjYsUAPMt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4044-8-0x0000000010000000-0x000000001000E000-memory.dmp

Download