863af398152dd47dec84afd9ded8de26b4d4cac1bbc3c46843608bf040b426c3

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118.exe
Size

829KB
MD5

fa00d610121f6bca2227ad2cdcaa9c87
SHA1

1d63a7a933aeeb40d53254651c0bb1188a59859b
SHA256

863af398152dd47dec84afd9ded8de26b4d4cac1bbc3c46843608bf040b426c3
SHA512

3936e9a43cb782897b6e0da52edace5031dbf92c5932081128d95dedd0f0b1a02ca25fa44c1d41a24c4a2056b454ab458c5cd024f3df22b8db5f6f08f93b6022
SSDEEP

24576:Z6o7JPnoSFnyconmKXVAlx1KISt/fpvrMVm7Z:b7J/oSF4ndVATM5fpvrP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118 = "\"C:\\Users\\Admin\\AppData\\Local\\72589977.exe\" 0 47 "	fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
180	2112	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 668
  2⤵
  - Program crash
  PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2112 -ip 2112
1⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-1-0x0000000001000000-0x0000000001434FF9-memory.dmp

Filesize
4.2MB

Download
memory/2112-2-0x0000000000500000-0x0000000000700000-memory.dmp

Filesize
2.0MB

Download
memory/2112-3-0x0000000000960000-0x0000000000962000-memory.dmp

Filesize
8KB

Download
memory/2112-4-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/2112-6-0x0000000001000000-0x0000000001434FF9-memory.dmp

Filesize
4.2MB

Download
memory/2112-8-0x0000000001000000-0x0000000001434FF9-memory.dmp

Filesize
4.2MB

Download
memory/2112-10-0x0000000000500000-0x0000000000700000-memory.dmp

Filesize
2.0MB

Download
memory/2112-11-0x0000000000960000-0x0000000000962000-memory.dmp

Filesize
8KB

Download
memory/2112-12-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads