4011ef06c8ab767c62a56b8f90bcda475485ef2a4199ea1dae324d13b4ade5d2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:36

Target

688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
Size

488KB
MD5

688b4e8b6a193a1ac67311491a3ce2a6
SHA1

90b224073e4051d2e904c3adad205a2b76bf9682
SHA256

4011ef06c8ab767c62a56b8f90bcda475485ef2a4199ea1dae324d13b4ade5d2
SHA512

ec0d503c7f99b0ffb33ea0b940a8ee11d7e13a07bb7a2b6e95ccf9c93a51cd74ef0c843fc35919a42706f31c9bdc8586429be078b44c7832c3e3e58998da4cd9
SSDEEP

6144:aFJ0PiJ5lAmVzjRmfcRB5edIMsnIzmw/nGWiYjXvhFuzj+h7DJL5qZ4Z+3pZ2ydy:xi2cRXYJzm4nGWXLvLufCxA3p1dy77T

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

befacajhdg_P.exe

pid process

4500 befacajhdg_P.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4388 4500 WerFault.exe befacajhdg_P.exe

pid	process
4500	befacajhdg_P.exe

pid	pid_target	process	target process
4388	4500	WerFault.exe	befacajhdg_P.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe

description	pid	process	target process
PID 5076 wrote to memory of 4500	5076	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe
PID 5076 wrote to memory of 4500	5076	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe
PID 5076 wrote to memory of 4500	5076	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe

C:\Users\Admin\AppData\Local\Temp\688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe
C:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe 4!0!6!1!1!6!7!7!5!9!7 K1BDQzwrMjEvKRkrU09BT0M9NisXKEpFTlZOTERCPzQpHC8+SFJOQj04JxkrQ0NDPCoZKEtJSEBVPVNeQz02KxcoT0VMVURMWE5NQzZkdG5vOSkobG1tJ0BFTUosTkhJKDhJTC5DTUVJGSg+Q0I/S0NDPBooPSw0Ji0gKUMxNyYqGyY9Lz0nMB8pPS04JCocLz40PCcqGSpHS0tET0JTWUlLRE06P1k3Hy5KS0g/TDxQXz9USzs2GSpHS0tET0JTWUc6SDw2HC8/V0RZTktHNBkrRVJEXj1GPUdAR0E9Gi5HSUxNWjlLS1dNRFE3LhkqS0E9TkVYTk9YTk1DNhwvUEw8LBkoP0oqOSApUVRITUJIPFhTRUZCTkc+Qkg4QEFVTEs8GihCTlZLUU5OSEw/Nm1tbF4cL0xEU09LR0RFQFtVTURRWT06VEo2LiApR0g+PlE4KBkrSU1eQ1NHOkhAPFtFSEJRU0lNQDs2YmFmcmQaKD1KTkdITztDXkNJNi0nMSoxKy8tMywnLCkrHC9KQFE7RUVAQ1hFTk1TQEZFNm9pbmEgKVNIRz42LCsuLDIuMjIqLhkqO0hTTkZOQD5YTUREPjkxLC4wMCgrKyguJjU0MTA0LS4lOEY=
2⤵
- Executes dropped EXE
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 228
3⤵
- Program crash
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4500 -ip 4500
1⤵
PID:3224

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe

Filesize
674KB

MD5
fa589ac7920c04eff43238d6cd6068ec

SHA1
3a3896dbf780c8af638d2fb47b8c6f6d877b293c

SHA256
e150aac75f5a442eefca075cc815e7baa1ade1a4559834e0f643ccc6baceda1f

SHA512
b251f959de836c768b7eb35c5f5d7128bd490015da09039f2131fda73b343aa0b586a6f97cd622bf9f57627987c21661b619087b89ccf3c4c5e88add3f5be0be

Download Submit