19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

Analysis

max time kernel
89s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
Size 254KB
Sample240401-s5txaagf3x
SHA256 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
MD5 73fe142254abec3aeaef375f0564d40a
SHA1 8529d972dd89f69eb2dc2a3ba9207e67626de9b9
SHA512 848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e
SSDEEP 6144:wBlL/ciQDQb+FraDHtBcDelxJu1cjf8Zx/saJJrBORxOZbmkZFPd:CeltxaPR8mL8Zx3JJrhRZb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3736	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3704	3736	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1888	3736	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	86
PID 3736 wrote to memory of 1888	3736	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	86
PID 3736 wrote to memory of 1888	3736	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"
  2⤵
  PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1060
  2⤵
  - Program crash
  PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3736 -ip 3736
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yhjjbtf.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm4CB9.tmp\yhjjbtf.dll
Size 33KB
SHA256 520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05
MD5 2109a0431e1e8fbce8007bc6dbdc8d2d
SHA1 f85d1cfa01ca893063af01510115bc279da84c2a
SHA512 a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb
SSDEEP 384:173rOmBpuRkCafMEILJBJn0GMZEhE7flHeKCB5qktAX6KiAEHpMUK6rbT7:171YiCeIdBMZT7f5eL5XfLzMUKcbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3736-8-0x0000000010000000-0x000000001000B000-memory.dmp

Download