a8e24c56aa790c2dd9446d373464e0ef12714636e1b199d3b1d34c03f48ad99e

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe
Size

707KB
MD5

f38aa4b20f2fcb014908ceeab98f2363
SHA1

f16fb2a5a327453c0275e3f8a4c710d4c51c4af1
SHA256

a8e24c56aa790c2dd9446d373464e0ef12714636e1b199d3b1d34c03f48ad99e
SHA512

85800a4cef1b36168ea6b02b6c166de23290cdc3690b8dc010094e470b075b6691682364e83eeefe07b9f117d227ec265ff4a67b2fa7685c1a41b2ea0a2eff43
SSDEEP

12288:Z66+pFG1DxxI4/OKMUd5O7rqOSNOm/ZYxAssF3Z4mxxnscWM/yuwjwO+:M6+bG13pOLiQ5m/GADQmXscmx1+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3404	3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	3404	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3404	3884	f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe	84
PID 3884 wrote to memory of 3404	3884	f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe	84
PID 3884 wrote to memory of 3404	3884	f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f38aa4b20f2fcb014908ceeab98f2363_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 548
    3⤵
    - Program crash
    PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe

Filesize
345KB

MD5
6705dcb6cd6d50d92f13c50aece0c811

SHA1
1dcc41d2d521e5584b3fc4ff04f82a8074e0e92e

SHA256
97303e458dcddb28b0bed8a3c59bf574be69ab1a7a468206ded3bc60ba279927

SHA512
62fb3dcee0792dfef1d0deed02e1db5744e1ec0aa1a745a486ce13364b366f82c988400b9e2bb4e2f760d8c55df45da8afacbf3ce43431e73d875fedb2a3379b

Download Submit
memory/3404-24-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/3884-19-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/3884-15-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/3884-4-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3884-5-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/3884-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/3884-7-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/3884-18-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/3884-20-0x0000000003120000-0x0000000003121000-memory.dmp

Filesize
4KB

Download
memory/3884-0-0x0000000001000000-0x00000000010C0000-memory.dmp

Filesize
768KB

Download
memory/3884-16-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/3884-17-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/3884-3-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/3884-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3884-13-0x00000000030C0000-0x00000000030C3000-memory.dmp

Filesize
12KB

Download
memory/3884-12-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/3884-11-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3884-10-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/3884-2-0x0000000000A40000-0x0000000000A94000-memory.dmp

Filesize
336KB

Download
memory/3884-1-0x0000000001000000-0x00000000010C0000-memory.dmp

Filesize
768KB

Download
memory/3884-25-0x0000000001000000-0x00000000010C0000-memory.dmp

Filesize
768KB

Download
memory/3884-26-0x0000000000A40000-0x0000000000A94000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads