744059fc8c989526ac33f8d85e7e8478a3eed48b2dff3e9574ab65bbb6f2494a

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
Size

73KB
MD5

e26812cdddfce9e9a18567d24f998e76
SHA1

aecf41bd6145b25dfb8d59155e8a42995a3c50fb
SHA256

744059fc8c989526ac33f8d85e7e8478a3eed48b2dff3e9574ab65bbb6f2494a
SHA512

954762f6d4c91dccf52460832bcdd645d9f4cb960f2d8fd61b9c875697e3fc8ea55097dd3985885ef4823b90416a7dea2129a2c4db12fe3cc919ac129beed573
SSDEEP

1536:1w2CL58G8H5G0SsNGIGoEl9je3Qw0HSSbiZsfHxHoiPX:+9nUNioEbje3Qw0HSSbks95

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

pid process

4940 e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

pid	process
4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

description	pid	process	target process
PID 4940 set thread context of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 228 WerFault.exe e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

pid process

4940 e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

pid	pid_target	process	target process
1424	228	WerFault.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

pid	process
4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

description	pid	process	target process
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
PID 4940 wrote to memory of 228	4940	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe	e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Temp\e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e26812cdddfce9e9a18567d24f998e76_JaffaCakes118.exe"
2⤵
- Maps connected drives based on registry
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 332
3⤵
- Program crash
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:5024

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Kj78fHc1F6Kkicf1.txt
Filesize
2KB

MD5
25a0e6a2590df6b5edefa0f51d214261

SHA1
8bbd2395db43b9838626eda00ca0acf6e822b94d

SHA256
3b979d97345639f940b7ac6231e25ae41cdaf7f6d851f482f3be4a6aeb8007d6

SHA512
c892cea34b5d68c293b8d8e71ad24d8a33094d0a7ca182c7931bc2f0a2c654c134269f3112e2902fa2f18b9c29e1d1288c141928944b0958e198bed941af8afb

Download Submit
memory/228-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/228-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/228-22-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/228-23-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download