0ec55e068544d099f1444376f5438d4885b80536b0cb518fa190c71a582fdee2

Analysis

max time kernel
140s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d289ea739688ff57553b80679bf8622_JaffaCakes118.exe
Size

2.0MB
MD5

3d289ea739688ff57553b80679bf8622
SHA1

c17eb9e743f3c14716d0a7eabe29707507c76ce4
SHA256

0ec55e068544d099f1444376f5438d4885b80536b0cb518fa190c71a582fdee2
SHA512

7506d044279966cc41eb0e38de77892feae8efd51e93ff65826b145dda3bee59c85403de2798f4a2a8c6be7ce7400fbc9c50e98726c5933116241e231114c091
SSDEEP

49152:zvLRzSIZ1Y3oMIzWG0ezAIxve4DpNsBniKpfKynky0lu:zLRnVD0ezAIxW4QBbncu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4088	3248	WerFault.exe	82
2380	3248	WerFault.exe	82
3588	3248	WerFault.exe	82
3120	3248	WerFault.exe	82
3096	3248	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	3d289ea739688ff57553b80679bf8622_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d289ea739688ff57553b80679bf8622_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d289ea739688ff57553b80679bf8622_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 752
  2⤵
  - Program crash
  PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 772
  2⤵
  - Program crash
  PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1424
  2⤵
  - Program crash
  PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1412
  2⤵
  - Program crash
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1448
  2⤵
  - Program crash
  PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3248 -ip 3248
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3248 -ip 3248
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3248 -ip 3248
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3248 -ip 3248
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3248 -ip 3248
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3248-0-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/3248-1-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/3248-2-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/3248-3-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/3248-4-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/3248-6-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/3248-5-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download