Analysis

  • max time kernel
    43s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 20:19

General

  • Target

    a22cfe45e6506faed5a82de112d6d6e9_JaffaCakes118.exe

  • Size

    824KB

  • MD5

    a22cfe45e6506faed5a82de112d6d6e9

  • SHA1

    5fdf13920c21ce47c38eeddb779876c32083b5da

  • SHA256

    aaa5ad3087ec9011c36cd77d5611f8d88fe72fc933e2469bad1703344b318767

  • SHA512

    dcef86282a00f2f0a0e509476d9992409798169b1342feef5818740e06438302afd05f08aaf32d6ebc476a5370b1cd7cc363a492df8a0b97922b3292acce6e12

  • SSDEEP

    12288:NxIOeB8PJwMIpP3ey7PQWbjLvo7nQpTPAQl1JW4Pr:NxItBeIZ/x7RPr

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a22cfe45e6506faed5a82de112d6d6e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a22cfe45e6506faed5a82de112d6d6e9_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 700
      2⤵
      • Program crash
      PID:1912
    • C:\Users\Admin\AppData\Local\Temp\a22cfe45e6506faed5a82de112d6d6e9_JaffaCakes118.exe
      start
      2⤵
      • Checks BIOS information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 700
        3⤵
        • Program crash
        PID:2292
    • C:\Users\Admin\AppData\Local\Temp\a22cfe45e6506faed5a82de112d6d6e9_JaffaCakes118.exe
      watch
      2⤵
        PID:4488
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 700
          3⤵
          • Program crash
          PID:2420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4268 -ip 4268
      1⤵
        PID:2664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4460 -ip 4460
        1⤵
          PID:3636
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4488 -ip 4488
          1⤵
            PID:2392

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4268-0-0x000000007FE30000-0x000000007FE4A000-memory.dmp

            Filesize

            104KB

          • memory/4268-1-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4268-4-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4268-3-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-60-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-63-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-7-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-81-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-82-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-80-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-78-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-77-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-70-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-25-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-72-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-73-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-74-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-75-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-69-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-68-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-61-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-62-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-79-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-5-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-71-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-34-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-33-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-32-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-31-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-30-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-29-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-28-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-27-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-26-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-37-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-38-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-40-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-39-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-64-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-65-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-66-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4460-67-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-19-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-14-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-55-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-53-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-52-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-51-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-50-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-49-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-48-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-47-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-46-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-44-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-59-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-57-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-58-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-54-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-45-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-43-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-24-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-20-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-21-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-22-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-23-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-10-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-13-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-56-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-15-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-16-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-17-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-18-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-12-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-11-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-9-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-8-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-6-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-84-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-93-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-92-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-91-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-90-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-89-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-88-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-87-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-86-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-85-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-97-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-98-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-96-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-95-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB

          • memory/4488-94-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB