Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 11:33

General

  • Target

    6e5e0d5db817aef86c9a4824913153ff_JaffaCakes118.exe

  • Size

    678KB

  • MD5

    6e5e0d5db817aef86c9a4824913153ff

  • SHA1

    ddcb74267e1b667d74e244c656c1d25127207418

  • SHA256

    fc31b4107bec4352fac3e1a13d91031b6b49969e21abff2301609219c43cd472

  • SHA512

    ba9ebd00c3d94f5121c0f9b022dffca3503863b66d437c28c65510bfa8475cddbf17d666c59fe6f18d7c61470353ec2e849d3e8f0f9bf9dce849792de78b8a4d

  • SSDEEP

    12288:YjZFxUi5TPcGEQv/e5/YM5vRupUF/seb3lfcflVHngv8DUpVj3s4jRinTC89Zc4I:cFxPckvU1/F7

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e5e0d5db817aef86c9a4824913153ff_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6e5e0d5db817aef86c9a4824913153ff_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 628
      2⤵
      • Program crash
      PID:964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1064 -ip 1064
    1⤵
      PID:3004

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1064-0-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-12-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-36-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-35-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-34-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-33-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-32-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-31-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-30-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-29-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-28-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-27-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-26-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-25-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-24-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-23-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-22-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-21-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-20-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-19-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-18-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-17-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-16-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-15-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-14-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-13-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-11-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-10-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-9-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-8-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-7-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-6-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-5-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-4-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-3-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-2-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB

    • memory/1064-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

      Filesize

      4KB