499619c6bc43585013dd421ef88cf14830c85a28bc3ce3984bcf62a24f6d59fc

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 02:45

Target

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
Size

489KB
MD5

ad76b9dfa5917952e3168986e670f683
SHA1

ddc0497585e60aa3bb95453be1ac1e82425d9b38
SHA256

499619c6bc43585013dd421ef88cf14830c85a28bc3ce3984bcf62a24f6d59fc
SHA512

a95f9e024c6c0ff7f969ad4bde9d6fd6b6861141d94ca3aee242c6dca35b7591545e49bcfed93e691293cdb4db1553b7a096865c10bdbdf3891844c5c816dca4
SSDEEP

6144:88LxBVFEg4x6f+WmGOYJ12CKRP+IWZRL0gZCPPnTr1TSvKsa5bcwJ:JFEg4xB+Id+/7LwnT7Xbc+

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid process

4164 ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3232 4164 WerFault.exe ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid	process
4164	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid	pid_target	process	target process
3232	4164	WerFault.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

description	pid	process	target process
PID 4164 wrote to memory of 4788	4164	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 4164 wrote to memory of 4788	4164	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 4164 wrote to memory of 4788	4164	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe"
  2⤵
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1052
  2⤵
  - Program crash
  PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4164 -ip 4164
1⤵
PID:2068

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsr3E52.tmp\fwvyvpj.dll

Filesize
30KB

MD5
7f78792ff322a3cf595eb8e9417ec39c

SHA1
93332d47608cc064ffdb1576c67cf609f4969476

SHA256
92b284f16e60425b34f717ce20e9a379eee29163d2d47d35845110e171cefef7

SHA512
c6353e3e3124f46f2132b45a08a9711806d8f2275848e600d9d8ba1a1eac0f74120a3d51260dede3e6a52d51533f82aa7e88ba199edeceeb456c174290e255b2

Download Submit
memory/4164-6-0x00000000751B0000-0x00000000751BC000-memory.dmp

Filesize
48KB

Download
memory/4164-9-0x00000000751B0000-0x00000000751BC000-memory.dmp

Filesize
48KB

Download