896c7582c90c506fb0c3fc69ed4e81266a47129f79682d89f76a5583c0113efa

Analysis

max time kernel
83s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 05:07

Target

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
Size

246KB
MD5

a3eb085e4d161a609f5c035930564a74
SHA1

07d92e7b9b0ad8876e6d76ebf4605303af83148e
SHA256

896c7582c90c506fb0c3fc69ed4e81266a47129f79682d89f76a5583c0113efa
SHA512

2b41587b2861c5aea71944b10e85d48188fe0c87c9d08422afbf3c54fd71b59fa7915fb927066881611230b5a9fcd4f5984c1f06016afe6c598e058931a5798e
SSDEEP

6144:X1onigKGh8Y5oFVV0KgJUz0Y+Ol3Wh1s5/ifLWAIDeG:loicxmETOgs5/ifKDR

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid process

4800 a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3900 4800 WerFault.exe a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid	process
4800	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

pid	pid_target	process	target process
3900	4800	WerFault.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

description	pid	process	target process
PID 4800 wrote to memory of 2036	4800	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 4800 wrote to memory of 2036	4800	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
PID 4800 wrote to memory of 2036	4800	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe	a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3eb085e4d161a609f5c035930564a74_JaffaCakes118.exe"
2⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 924
2⤵
- Program crash
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:4592

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsp84B3.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/4800-6-0x0000000002250000-0x000000000226F000-memory.dmp

Filesize
124KB

Download
memory/4800-7-0x0000000002250000-0x000000000226F000-memory.dmp

Filesize
124KB

Download