cf9565db0c7e242dafc592fd88893bf46a3201a17372675fef4cfcbd558d1c5b

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe
Size

501KB
MD5

cbea4cf442e07bb6aa122f1b8eddef4d
SHA1

d741e5ed6ea3c6d0fb068423a9637e5efa384142
SHA256

cf9565db0c7e242dafc592fd88893bf46a3201a17372675fef4cfcbd558d1c5b
SHA512

90258c71eb5cc4379c7438f31136d0a2af5e44ad7fbb88c08df1de7cb6d3f954711bad0a18cbb144bd5d70ae7827c25888ce240f54af93d9ff049e725d253248
SSDEEP

12288:VSzmwxmwfYOxjTX4tFrM/lxZvrw9bd1kgc:+mwxwO6NulxZc5d1kj

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4512	cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	4512	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1416	4512	cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe	84
PID 4512 wrote to memory of 1416	4512	cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe	84
PID 4512 wrote to memory of 1416	4512	cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\cbea4cf442e07bb6aa122f1b8eddef4d_JaffaCakes118.exe"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1008
  2⤵
  - Program crash
  PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4512 -ip 4512
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\yfvmdnif.dll

Filesize
33KB

MD5
c6f46b711b17ddbcb63a52552f1545fd

SHA1
7f0cf73617829660b06ead76dc37db322f48a565

SHA256
fd1e3db80099afb4fad792e226d1055b350ee96286633a356926b7ac180932b0

SHA512
25862ccaab810ba1ac3c58b12aa8c114d25436f3f5273c4c59621044b398aa98f4d40569e5232aeaf1ef41c4e396ad172faa71de92aae8d196ad947666cc94f7

Download Submit
memory/4512-8-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download