100e70474a3f7179f1c69ba6c88824477ee0a09540d2e666fd0f59770220276d

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d2654649d3b68734f301623a751873a_JaffaCakes118.exe
Size

277KB
MD5

2d2654649d3b68734f301623a751873a
SHA1

18b0a6cb6d2f38e71603b49fd206cce6d5107b7e
SHA256

100e70474a3f7179f1c69ba6c88824477ee0a09540d2e666fd0f59770220276d
SHA512

7095ab9eefaa3079c09a8559b4587e213e86e853dc24753a69ca004f33f34087ae35f927c281299092f27d75194c329cbe7e3db962e3587614f429158b122c78
SSDEEP

6144:yPTye1eli1yt9V3eXxdaDgtFQs2wkv/iB8tmc+:+H1BcDV3eXxEDgtFQsUHi6tmd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4564	NeroChtik.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\NeroChtik.exe	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe
File opened for modification	C:\Windows\NeroChtik.exe	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe
File created	C:\Windows\UNINSTLA.BAT	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2528	1668	WerFault.exe	81
4224	4564	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe
Token: SeDebugPrivilege	4564	NeroChtik.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4564	NeroChtik.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 892	4564	NeroChtik.exe	90
PID 4564 wrote to memory of 892	4564	NeroChtik.exe	90
PID 1668 wrote to memory of 1652	1668	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe	93
PID 1668 wrote to memory of 1652	1668	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe	93
PID 1668 wrote to memory of 1652	1668	2d2654649d3b68734f301623a751873a_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\2d2654649d3b68734f301623a751873a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d2654649d3b68734f301623a751873a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 632
  2⤵
  - Program crash
  PID:2528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTLA.BAT
  2⤵
  PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1668 -ip 1668
1⤵
PID:5048

C:\Windows\NeroChtik.exe
C:\Windows\NeroChtik.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 600
  2⤵
  - Program crash
  PID:4224
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4564 -ip 4564
1⤵
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\NeroChtik.exe

Filesize
277KB

MD5
2d2654649d3b68734f301623a751873a

SHA1
18b0a6cb6d2f38e71603b49fd206cce6d5107b7e

SHA256
100e70474a3f7179f1c69ba6c88824477ee0a09540d2e666fd0f59770220276d

SHA512
7095ab9eefaa3079c09a8559b4587e213e86e853dc24753a69ca004f33f34087ae35f927c281299092f27d75194c329cbe7e3db962e3587614f429158b122c78

Download Submit
C:\Windows\UNINSTLA.BAT

Filesize
218B

MD5
2285dfffcedea6bd18ab4e67bdf30f5f

SHA1
308ad1869ccde1fa09fcc7bddca1904842bcbed2

SHA256
8b44a487625793612e40e314569c7cca276288fac92c218f6e8d04cd21b05329

SHA512
06d825ce9e94709dadea0fb34d16b8af8e40456dacade85654b3b8ae760f9ca07f1fc7c63f6c1e938ef2f258647a6ada60a1c683fe087367a6cd6779cef0769f

Download Submit
memory/1668-12-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1668-3-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1668-4-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/1668-2-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1668-11-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1668-0-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/1668-14-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/1668-1-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/4564-9-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/4564-10-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/4564-13-0x0000000000400000-0x0000000000557000-memory.dmp

Filesize
1.3MB

Download
memory/4564-15-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4564-17-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download