226b304ce92e897f7c0b1b5bf4861267b2452e95241eaf08525d84f153dacb65

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe
Size

1024KB
MD5

8db046a709e8b053c57774d3168db7b2
SHA1

4ce699b827ede5c7bd4edc50808e6274e279384b
SHA256

226b304ce92e897f7c0b1b5bf4861267b2452e95241eaf08525d84f153dacb65
SHA512

181120eff687002819bad999600f701a42865ea2a827a4541510e3911e9ffa60dd07df892fc19690faf8ff5f2039327c2b665a36f5e3bbf97a4eba58f2e0e438
SSDEEP

12288:Y6mfpCU7TXk/ACCz7mI2IWtqfg7/LeDJNlVyOw9JBPu4H8BiEE9YYKPKY:Y6mfpv0ICCzKIfksg7K+vcfYK3

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
4	drive.google.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
716	5636	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe"
1⤵
PID:5636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 1220
  2⤵
  - Program crash
  PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5636 -ip 5636
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads