Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 08:38

General

  • Target

    cecc78ed347139f523e7cbf43fb89bdc_JaffaCakes118.exe

  • Size

    148KB

  • MD5

    cecc78ed347139f523e7cbf43fb89bdc

  • SHA1

    a5a49618670fe45ff626ecf39b5cb52f9e965615

  • SHA256

    04217896a12cf9b3d6532adb25da13bc217b9df8a0a75ed075b2c92ab8dfe129

  • SHA512

    680140bf7fa09054ef4c8bdb55fbbdbbcf28b7374e12826420674a4661b77d3c66623ccdc0a85efb70c0a1042047cbad7df3582f104246b2a2d579263fbcb2e7

  • SSDEEP

    1536:Cv+pJdyvHh9Yvu356AlGC/kpNfDnfn8bbxvVOu3MwJMaKtqj78gE8v27O:J/dwh9uu39N81SbxthE8vCO

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2812
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3492
      • C:\Users\Admin\AppData\Local\Temp\cecc78ed347139f523e7cbf43fb89bdc_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\cecc78ed347139f523e7cbf43fb89bdc_JaffaCakes118.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2156
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 636
            4⤵
            • Program crash
            PID:1204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2156 -ip 2156
      1⤵
        PID:4544

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2156-5-0x0000000000CD0000-0x0000000000CD7000-memory.dmp

        Filesize

        28KB

      • memory/2156-10-0x0000000000CD0000-0x0000000000CD7000-memory.dmp

        Filesize

        28KB

      • memory/2156-16-0x0000000000CD0000-0x0000000000CD7000-memory.dmp

        Filesize

        28KB

      • memory/2156-17-0x0000000000CD0000-0x0000000000CD7000-memory.dmp

        Filesize

        28KB

      • memory/2156-8-0x0000000000CD0000-0x0000000000CD7000-memory.dmp

        Filesize

        28KB

      • memory/2156-7-0x0000000076FF2000-0x0000000076FF3000-memory.dmp

        Filesize

        4KB

      • memory/2812-14-0x00000000002C0000-0x00000000002C7000-memory.dmp

        Filesize

        28KB

      • memory/2812-15-0x00000000002C0000-0x00000000002C7000-memory.dmp

        Filesize

        28KB

      • memory/3492-6-0x0000000002950000-0x0000000002957000-memory.dmp

        Filesize

        28KB

      • memory/3492-3-0x0000000002950000-0x0000000002957000-memory.dmp

        Filesize

        28KB

      • memory/3492-9-0x00007FFFD602D000-0x00007FFFD602E000-memory.dmp

        Filesize

        4KB

      • memory/4684-1-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/4684-12-0x0000000000400000-0x0000000000404A00-memory.dmp

        Filesize

        18KB

      • memory/4684-13-0x0000000002530000-0x0000000002F30000-memory.dmp

        Filesize

        10.0MB

      • memory/4684-2-0x00000000021C0000-0x00000000021C2000-memory.dmp

        Filesize

        8KB

      • memory/4684-4-0x0000000002530000-0x0000000002F30000-memory.dmp

        Filesize

        10.0MB

      • memory/4684-0-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB