dac3c80a4012abff4b112bed6050aae6a8fc8221ac652af65e526428a54f4805

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe
Size

504KB
MD5

3bb4ff5b5a89a36b3d778c2eb16e78db
SHA1

b9c448d3353e334b989534d18e790996fc1e0ff5
SHA256

dac3c80a4012abff4b112bed6050aae6a8fc8221ac652af65e526428a54f4805
SHA512

8d06c5a36c00c52209f4d59c36f955bf9b104d8f538aeef34dd4739959f8cb4860b6e0039ba4c1a5907c92f1eb53e859c6a86490b39ee7cd1f0b6825ef3b9404
SSDEEP

12288:k6PSxv0wQ/aD3cknoqCLd3n8ULVVAwBEzDRZ452Vn:k6BwAGoPL6ULV2NR+5w

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2624	WerFault.exe
2624	WerFault.exe
2624	WerFault.exe
2624	WerFault.exe
2624	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	2912	WerFault.exe	27

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe:Zone.Identifier	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1712	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	28
PID 2912 wrote to memory of 1712	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	28
PID 2912 wrote to memory of 1712	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	28
PID 2912 wrote to memory of 1712	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2844	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2844	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2844	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2844	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2624	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2624	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2624	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2624	2912	3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 856
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3bb4ff5b5a89a36b3d778c2eb16e78db_JaffaCakes118.exe

Filesize
504KB

MD5
3bb4ff5b5a89a36b3d778c2eb16e78db

SHA1
b9c448d3353e334b989534d18e790996fc1e0ff5

SHA256
dac3c80a4012abff4b112bed6050aae6a8fc8221ac652af65e526428a54f4805

SHA512
8d06c5a36c00c52209f4d59c36f955bf9b104d8f538aeef34dd4739959f8cb4860b6e0039ba4c1a5907c92f1eb53e859c6a86490b39ee7cd1f0b6825ef3b9404

Download Submit
memory/2912-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000000820000-0x00000000008A8000-memory.dmp

Filesize
544KB

Download
memory/2912-2-0x0000000004D70000-0x0000000004E2A000-memory.dmp

Filesize
744KB

Download
memory/2912-3-0x00000000005F0000-0x000000000061A000-memory.dmp

Filesize
168KB

Download
memory/2912-4-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-5-0x00000000008E0000-0x00000000008E8000-memory.dmp

Filesize
32KB

Download
memory/2912-6-0x00000000008F0000-0x00000000008FC000-memory.dmp

Filesize
48KB

Download
memory/2912-7-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2912-13-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2912-14-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download