6dbd578bacfac6bee49b778b85cd62926c65a7f23bb33ceec705686474308898

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe
Size

430KB
MD5

439ec2917b590c3172a790f519f751b7
SHA1

5280d1249d0ca942d22d6c78cf864f129d867b65
SHA256

6dbd578bacfac6bee49b778b85cd62926c65a7f23bb33ceec705686474308898
SHA512

012e86735aeac946c4f9d419befa80801f8912c711eb33531e49bb11b993ac339c845e1a2761485f0e2d37e1e5d877201542ba5927a9c90cc371683045bb5ebf
SSDEEP

6144:G8LxBVkCInwNqWBD5Xz560A5A8/0FwN47sfJUhhRXmRNOE6SIfBQW8aFm6HlVGjM:bFBtLAq8c7bhh/l58aA6FVGj45

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3176	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
376	3176	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2512	3176	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	86
PID 3176 wrote to memory of 2512	3176	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	86
PID 3176 wrote to memory of 2512	3176	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe"
  2⤵
  PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 1000
  2⤵
  - Program crash
  PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3176 -ip 3176
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu9F1F.tmp\gnokeofcx.dll

Filesize
17KB

MD5
1d6dbd89d81d6216f259c9f35c40c42c

SHA1
b0b25bbb32c2c8b06e8a2a12706ca25e85bfb850

SHA256
781e084ab8b4ee8388ff2cbc44c502f0d1aa164556c80931ca12a9e8d525f500

SHA512
aa94d3ac2e64901141fc3102263f547e245546ba44db4215848063206d9fbb7af6e4dde075fd8ac16a06e0c8ab94f56922b2dc76b4fe301ba436f106e0cbe856

Download Submit