Analysis

  • max time kernel
    139s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-05-2024 19:28

General

  • Target

    511bf43e720a8cf9131a1ba0ab89d089_JaffaCakes118.exe

  • Size

    271KB

  • MD5

    511bf43e720a8cf9131a1ba0ab89d089

  • SHA1

    1ac25149aaa08db57d87e4fe0a3389da72752dc6

  • SHA256

    b04fcd4778f72c0a66bd4319b54bc722365a4783ac2347bc77602f19e64da13c

  • SHA512

    6f55a75aed1d0192a5207c9680a9b81e33f6f8ad4b85aaabcd8017d139352ca15a926a5239480d3b249ec936ae7352911b5ad560202316da725be6dc2b89a33e

  • SSDEEP

    6144:vfgFQoFek+uf8ingJDcp2L4ZacdAjuM98X/NPfAuZ:XtoGSVp2LBZPYNAuZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\511bf43e720a8cf9131a1ba0ab89d089_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\511bf43e720a8cf9131a1ba0ab89d089_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Local\Temp\511bf43e720a8cf9131a1ba0ab89d089_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\511bf43e720a8cf9131a1ba0ab89d089_JaffaCakes118.exe"
      2⤵
        PID:4220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 856
        2⤵
        • Program crash
        PID:3156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4432 -ip 4432
      1⤵
        PID:4932

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\System.dll
        Filesize

        11KB

        MD5

        ca332bb753b0775d5e806e236ddcec55

        SHA1

        f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

        SHA256

        df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

        SHA512

        2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

      • memory/4432-14-0x0000000002F10000-0x0000000002F3D000-memory.dmp
        Filesize

        180KB

      • memory/4432-16-0x0000000002F10000-0x0000000002F3D000-memory.dmp
        Filesize

        180KB