10663b0ffc940659bd5a05aebd7b1ba7b5b9586943f1f4dc6c08b7f4a104252a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 18:57

Target
a1ddc25d3f9f4fb9015418a647d5d58f_JaffaCakes118.exe
Size 102KB
Sample240612-xmd6bswcrc
SHA256 10663b0ffc940659bd5a05aebd7b1ba7b5b9586943f1f4dc6c08b7f4a104252a
MD5 a1ddc25d3f9f4fb9015418a647d5d58f
SHA1 7a95094edfba916c2613673e4bb431bc393467c0
SHA512 5379a85c8b9ab7bbbbdd7acc5d91fbbc14bbb7df32bb3f7f185bb84d7f2dfe468d745e16893d3ee84f4feb6e2d80b9fcf318bf1747fcf04c99f6fe4d21907d18
SSDEEP 1536:tZZavSLDDD7up61HORGDuZhKNvBH6/qXBMQTYfN7fCTcecFRFgsWjcdBHLyb1Yvz:tiKDO6tg8vBH6/KZA5/PBHeb1YvY4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	4868	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	a1ddc25d3f9f4fb9015418a647d5d58f_JaffaCakes118.exe
4868	a1ddc25d3f9f4fb9015418a647d5d58f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a1ddc25d3f9f4fb9015418a647d5d58f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1ddc25d3f9f4fb9015418a647d5d58f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1252
  2⤵
  - Program crash
  PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4868 -ip 4868
1⤵
PID:4788

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact