27c92fe6c131c4f41f6d524837ba073f396130658c51108f94cb514b7f571dc4

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe
Size

283KB
MD5

c62b0f6c44abf03c26dab89826464f74
SHA1

9ca8c875e687baa367a35873a85c9916cf3a4c2b
SHA256

27c92fe6c131c4f41f6d524837ba073f396130658c51108f94cb514b7f571dc4
SHA512

d0b8272134709b5aa04712f04f7f1bf02fca9e377e80ee1956b8134df0197fe7d4e94287146e47a828c89fc201dbb4679b87896153f93261d1a5741c56140a62
SSDEEP

6144:PBlL/IkB3YxRxiY0FXe0M6t2BrlkKxXR9vYsfE:pSkB3YxRxMFXY/llR9A1

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2248	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	2248	WerFault.exe	84

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1776	2248	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	87
PID 2248 wrote to memory of 1776	2248	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	87
PID 2248 wrote to memory of 1776	2248	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	87
PID 2248 wrote to memory of 1776	2248	c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c62b0f6c44abf03c26dab89826464f74_JaffaCakes118.exe"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 1032
  2⤵
  - Program crash
  PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2248 -ip 2248
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh3384.tmp\lyinn.dll

Filesize
26KB

MD5
b7f9a167c3af210c5a0be8393b9f04e2

SHA1
8e540308abf226139bf08c61fa21598c0eb055da

SHA256
fd6451ef4e817f604a14be5ab85b5e9890a276ba877d38a9b9544c41ed4718a7

SHA512
75a44e8939f23fa143b67fbd664b81758c0718343e7cb3836b5651bd87e0533d03973b34cbb7b03b50a1fb3828fb0ddf93b205f42e0c8198bfb575088dc9b128

Download Submit
memory/2248-8-0x0000000074380000-0x000000007438A000-memory.dmp

Filesize
40KB

Download