c3c05d03d6fddacf0013303e709fbb023d1f6b546c7f66205aca4b7cbdc0b00b

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 04:28

Target
026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe
Size 298KB
Sample240427-e36w6sbg8t
SHA256 c3c05d03d6fddacf0013303e709fbb023d1f6b546c7f66205aca4b7cbdc0b00b
MD5 026c2a655d973ee77f5c66b9fc456f4d
SHA1 590d0920f6bac96fc88ea5cdfd66d6ea87cae76e
SHA512 82d42d1386e1b0fcd8ec89a93b9841a05835bc3e088a29eecfcfa6374d9bc855cb02041906014fa274f069617131a0f251860391e160cb73ba5bdd8b47a2babc
SSDEEP 6144:kLoQSLYd7WLD8e5vCdF+aqnDHHmLn2b2:kHS87WPkF+aBr2b2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 3 IoCs

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ad405cn\iePlayer.exe	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe
File created	C:\Windows\ad405cn\ATLcom.dll	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe
File created	C:\Windows\ad405cn\Update.exe	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe
File created	C:\Windows\ad405cn\info2asp.exe	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
392	2852	WerFault.exe	83
436	2984	WerFault.exe	88
3128	2984	WerFault.exe	88

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1464	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	82
PID 2336 wrote to memory of 1464	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	82
PID 2336 wrote to memory of 1464	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	82
PID 2336 wrote to memory of 2852	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	83
PID 2336 wrote to memory of 2852	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	83
PID 2336 wrote to memory of 2852	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	83
PID 2336 wrote to memory of 2984	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	88
PID 2336 wrote to memory of 2984	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	88
PID 2336 wrote to memory of 2984	2336	026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\026c2a655d973ee77f5c66b9fc456f4d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\ad405cn\Update.exe
  C:\Windows\ad405cn\Update.exe 0ECF425C63BA9ACDBA47BAF5861CFA28008969FBE20BBAD186FEAE78BE407E63C6D7BF10A766D0315F87152C1E16CB7C17DE55EC
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\ad405cn\info2asp.exe
  C:\Windows\ad405cn\info2asp.exe 0ECF425C63BA9ACDBA47BAF5861CFA28008969FBE20BBAD186FEAE78BE407E63C6D7BF10A766D0315F87152C1E16CB7C17DE55EC
  2⤵
  - Executes dropped EXE
  PID:2852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 520
    3⤵
    - Program crash
    PID:392
- C:\Windows\ad405cn\iePlayer.exe
  C:\Windows\ad405cn\iePlayer.exe 0ECF425C63BA9ACDBA47BAF5861CFA28008969FBE20BBAD186FEAE78BE407E63C6D7BF10A766D0315F87152C1E16CB7C17DE55EC
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 444
    3⤵
    - Program crash
    PID:436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 444
    3⤵
    - Program crash
    PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 2852
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2984 -ip 2984
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2984 -ip 2984
1⤵
PID:968

Update.exe

Path C:\Windows\ad405cn\Update.exe
Size 56KB
SHA256 e49242884ade2b83e5fc6f5f5d46dfa57308b5e8994c34a152ab07217ca0ec8e
MD5 f7c0f5f0e128b91015610a81199f8213
SHA1 a76b89d0e4c8361de5dc7770caa8037088cf9ced
SHA512 f9b4c898b59a08271184543dbb6b0280ed52ced239525e7822a7539d9591720783b789bb4eac0a545bbe53f477f00222898f25b433290c9aad2c36fa0e079cd3
SSDEEP 768:SU3Ueqzd6WSv+1vLFOLI5UpZBiJwyXhF16woNc21t2YkRuSANEv6FMLS55zyOw:fqzdMWULI5AZBAxbpoeUZksS3In5zb
MD5 SHA1 SHA512 SSDEEP

Submit Download

iePlayer.exe

Path C:\Windows\ad405cn\iePlayer.exe
Size 67KB
SHA256 01c046fcf95c81b906be809b85878de78ee1cb7539062a6a68e46adb8dbd329a
MD5 89b87331d4b589d681700ab5bbd60b13
SHA1 759d9097414895d8b6cbd4dcb042bc00a86d0255
SHA512 169a406ed651e427038c8e7fff4b7260a2d63c090d8e0e7b053d0dddd604db41f7d60b94bb55fb3d69f2b0c27fe13caa6cc59e8b5b37afa6ec7cf5d80957968d
SSDEEP 768:/QV86YcIKjhLQnczNLSlwc+THuAlZz/UJiJcqDq+C0wDNmXydMRTVdDKof:4V8wIEfLyw9HJZz7Oeq+6Y3RTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

info2asp.exe

Path C:\Windows\ad405cn\info2asp.exe
Size 41KB
SHA256 6b8e45f4103162c42d9e5b543c92fc1bbb40ec65e0f14837ded80c4df0ef5ded
MD5 54348aae890a217b7b9b13140eb861d6
SHA1 a6d667336eb0c95bba5ee9754ec81be2e1988e9d
SHA512 01c78da86f25bd361171c1d6b73e8d903b8ae9652c1f93b65e3712dae6bb798bf81d5b012d5f00b4376ed59118efc0f7201a76104e7f2a680a3242ce8ce67531
SSDEEP 768:sEWlRTLbM9lybs7dfaoEgqnt3iYCO6Fsi8C6Re7:sE8LYfl7vRqnt3i32Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download