10012b6185457cc008e74c63602e39ccc862866cfecb5f2ab04b1aa9e9edde9a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe
Size 248KB
Sample240404-2vtyzacf5x
SHA256 10012b6185457cc008e74c63602e39ccc862866cfecb5f2ab04b1aa9e9edde9a
MD5 c3f2050787e70cc38227bb4489e46865
SHA1 a6c0c399c51172400274049a0c938b9f7ad7411a
SHA512 5474e00a3264a5cfe51c6c5582962888f8fcc8482f423b7e5a69776c89d1de8ece6b2cf2902fe732607272b2006a6bb80a4003a3cba75b36e9628171cdb2f820
SSDEEP 6144:wBlL/cunaDKUurO6gvBUnINSsHOhcUFXjE:CeunaDirO62C1s8TE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2080	c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2080	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1624	2080	c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe	88
PID 2080 wrote to memory of 1624	2080	c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe	88
PID 2080 wrote to memory of 1624	2080	c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c3f2050787e70cc38227bb4489e46865_JaffaCakes118.exe"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1008
  2⤵
  - Program crash
  PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2080 -ip 2080
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zglbbz.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5881.tmp\zglbbz.dll
Size 28KB
SHA256 ce31d179d783748cf50244baf49d5a59643740c16c0fb77253ddf79b9b2b7048
MD5 2a4a17df7d15fbdd5d79def67aa868c4
SHA1 6f213e4f6c99e9cccc6f885a1fbc208e699bd7c3
SHA512 c9bfc03e6d92645f90c2a35f5b9b42226c4651f6bdafb4d99236f966e88dba3b8188bc44630f7b73cc7817b26f28ea78b72f016dbb845604ee03f0c96a9a0e8e
SSDEEP 384:g97T95oBiNHxHGEahEewcswd3MevEFmJkkdoiWgAhdiFc5/aD9eBEL2WhYTn3gdh:gdp50G0thEwIevOklfCiy5/RBE6Sr
MD5 SHA1 SHA512 SSDEEP

Submit Download