Analysis

  • max time kernel
    94s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 10:15

General

  • Target

    2ff733dbb9b655a057ed7dfc2ea13daf_JaffaCakes118.exe

  • Size

    572KB

  • MD5

    2ff733dbb9b655a057ed7dfc2ea13daf

  • SHA1

    c1d27a666129297faffab19528a1a2864e8d52c3

  • SHA256

    071820da24f6b704ce6356e79ded9baad1acaa5e400fb8727c33bae6aa6f7a2f

  • SHA512

    c251ae16ffcac19858957029589accfdfc1df28ed3a3c9f2db25ddc22ae8bf9690b8a22304529ec2965ef465fea3398cd06b382e85ea8fb3a7d9d9aba8933cff

  • SSDEEP

    12288:ys8yx7i2iadN8gZE4DO5ABBCkwJbt4N8AS4EWtEjOBiZaB9BeuON/HcDfRjALs:PhG2iYeWAQaToEsOGiZawuON/HUf56s

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ff733dbb9b655a057ed7dfc2ea13daf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2ff733dbb9b655a057ed7dfc2ea13daf_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Users\Admin\AppData\Local\Temp\2ff733dbb9b655a057ed7dfc2ea13daf_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2ff733dbb9b655a057ed7dfc2ea13daf_JaffaCakes118.exe"
      2⤵
        PID:892
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1016
        2⤵
        • Program crash
        PID:2132
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 764 -ip 764
      1⤵
        PID:2528

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsc5763.tmp\sixepu.dll

        Filesize

        17KB

        MD5

        040853f7eb99fcc82ea269734850785e

        SHA1

        8f18a3e2d9349d60de78194fcb62b7775cd297d6

        SHA256

        0f68d5467617881e66690c950d2d2f409129662d2f78d6b648a2e2bf89bf33c0

        SHA512

        cf5cd1fc536cec5d2c9735ad8129dd7990ef998403dd171bb5daf4b6d468beeb1d4a264124c701e57a89103231273b577e2a3858cd056182739e384395c56b6b