Overview

overview

7

Static

static

3

2b660ef15f...18.exe

windows7-x64

7

2b660ef15f...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    96s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 07:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2b660ef15fe01081fe07d5abe83c9b36_JaffaCakes118.exe

  • Size

    520KB

  • MD5

    2b660ef15fe01081fe07d5abe83c9b36

  • SHA1

    56b5597e22618f21d30586e621c5f276ea7c2931

  • SHA256

    426721efc81727101498320642651960b684dcc5546baf6881f6afac4fdf36c9

  • SHA512

    b46ff0415e8b762ee8deffbf349d92d2d95c0ec2f09c16f2a8c03f9d8307a30a391cae7e3ade6586052d03009d31b31043992a1685631cc043a66b4d56cc3079

  • SSDEEP

    12288:ydiM1Wtvs51uGnPOj7sJIdcu8sjI8UMty0ZazH:aidtE51hPOwISsRhy0A

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Program crash 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b660ef15fe01081fe07d5abe83c9b36_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2b660ef15fe01081fe07d5abe83c9b36_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 220
      2⤵
      • Program crash
      PID:4080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 260
      2⤵
      • Program crash
      PID:3792
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5072 -ip 5072
    1⤵
      PID:2264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5072 -ip 5072
      1⤵
        PID:2980
      • C:\Windows\SysWOW64\winine.exe
        C:\Windows\SysWOW64\winine.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 216
          2⤵
          • Program crash
          PID:4052
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 236
          2⤵
          • Program crash
          PID:2696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4588 -ip 4588
        1⤵
          PID:2448
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4588 -ip 4588
          1⤵
            PID:4496

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\SysWOW64\winine.exe
                  Filesize

                  520KB

                  MD5

                  2b660ef15fe01081fe07d5abe83c9b36

                  SHA1

                  56b5597e22618f21d30586e621c5f276ea7c2931

                  SHA256

                  426721efc81727101498320642651960b684dcc5546baf6881f6afac4fdf36c9

                  SHA512

                  b46ff0415e8b762ee8deffbf349d92d2d95c0ec2f09c16f2a8c03f9d8307a30a391cae7e3ade6586052d03009d31b31043992a1685631cc043a66b4d56cc3079

                  Download Submit

                • memory/4588-5-0x0000000000760000-0x0000000000761000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5072-0-0x0000000002280000-0x0000000002281000-memory.dmp

                  Filesize

                  4KB

                  Download