accb399db6dbdcadd7022d05a258993119e3abeed04394921ae0aa14b2b468bf

Resubmissions

11-05-2024 17:57

240511-wjxylaac6s 10

11-05-2024 17:54

240511-whck9sab7y 10

Analysis

max time kernel
4s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
Size

472KB
MD5

35d38360b8f7bfe5ecc9dd3b5c1eabec
SHA1

c0d74936f84101199acf01a9e5951478f2cf91ba
SHA256

accb399db6dbdcadd7022d05a258993119e3abeed04394921ae0aa14b2b468bf
SHA512

2a3a851a4090936a15c9d9cbe391afd82906ff66ec913daeead0d56098429b5ed76e0aa7d6cda845de3130c417681fd09154c4a9c9907237a934f8036aac532b
SSDEEP

6144:YKAGqv0MkNUfrQVSSpn9FXDi57PXF0jB5IX3R7FGb7:YK3qUArQVSUWMB52RpGP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	2504	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3412	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	81
PID 2504 wrote to memory of 3412	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	81
PID 2504 wrote to memory of 3412	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	81
PID 2504 wrote to memory of 992	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	82
PID 2504 wrote to memory of 992	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	82
PID 2504 wrote to memory of 992	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe"
  2⤵
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe"
  2⤵
  PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 328
  2⤵
  - Program crash
  PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2504 -ip 2504
1⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-10-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-9-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-18-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-17-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-16-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-15-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-14-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-13-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-12-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-11-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-36-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-8-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-7-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-6-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-34-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-35-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-21-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-41-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-40-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-39-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-38-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-37-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-33-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-32-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-31-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-30-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-29-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-28-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-27-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-26-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-25-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-24-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-23-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-22-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-20-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-19-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-5-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-4-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-3-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-2-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-1-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-0-0x0000000000F30000-0x0000000000F36000-memory.dmp

Filesize
24KB

Download