063b3a7bbeaff886a696e81d2e4ed80f4c175cd3f186a51cf8690d441a968b04

Analysis

max time kernel
114s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:04

Target

25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Size

117KB
MD5

25e82bc60771a537aa4f5f79a1abef69
SHA1

5f17b9854a57434c4eae36dea580c92dd2bb9218
SHA256

063b3a7bbeaff886a696e81d2e4ed80f4c175cd3f186a51cf8690d441a968b04
SHA512

b08b1aed78f883308dee63601c84d0aecf917c29d101d259746a7d2148b69f6658a5f58266f7e665b7bc39d6df3ecbb00d41dc088e2905f5e6a2ca096f0f6a2d
SSDEEP

3072:v7GaEUOXZbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7kXG:a97BwvP6bQ7yMP+DE8270G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	3132	WerFault.exe	84

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\mac = "EE-FA-70-36-A9-57"	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlt = "1720119941"	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlloadtime = "1720119941"	25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25e82bc60771a537aa4f5f79a1abef69_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 1052
  2⤵
  - Program crash
  PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3132 -ip 3132
1⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1300,i,6959856223548986108,4217696995639198458,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
1⤵
PID:2848

memory/3132-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3132-1-0x00000000021A0000-0x00000000021D0000-memory.dmp

Filesize
192KB

Download
memory/3132-2-0x00000000021D0000-0x00000000021D2000-memory.dmp

Filesize
8KB

Download
memory/3132-8-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/3132-7-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3132-4-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/3132-6-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3132-5-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3132-9-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/3132-10-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3132-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3132-12-0x00000000021A0000-0x00000000021D0000-memory.dmp

Filesize
192KB

Download