9108997ed7a98a7abe8ff92f631c4a0d48ecebdaee9511707da9127a9ec55dcc

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
Size

354KB
MD5

44b317f22e4f8b434457bd4e716ffcdf
SHA1

69178bd12b0cf4224fea5ddc0b4d4da450a9bab3
SHA256

9108997ed7a98a7abe8ff92f631c4a0d48ecebdaee9511707da9127a9ec55dcc
SHA512

7e9a0cedbdaadd36a8d40d7cc41e3a495d830db080229c9a3b155d4a9508edd5a0272819f96bb53b105f47562e5f065ff7a30edcc6afd02863ad055ac3320d7b
SSDEEP

6144:WiOgCOUoL9sewNglEO/JUYfxVc5Iv01RtazG3TpqRIjVCZFmrMD2u5LYeaszuQ:Tpso/+8Pc5IsWhKjAtD/5LraO

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
668	nEbMdKo17902.exe

Executes dropped EXE 1 IoCs

pid	Process
668	nEbMdKo17902.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nEbMdKo17902 = "C:\\ProgramData\\nEbMdKo17902\\nEbMdKo17902.exe"	nEbMdKo17902.exe

Program crash 30 IoCs

pid	pid_target	Process	procid_target
1480	2800	WerFault.exe	82
4360	2800	WerFault.exe	82
2888	2800	WerFault.exe	82
3172	668	WerFault.exe	91
5012	2800	WerFault.exe	82
4784	668	WerFault.exe	91
960	2800	WerFault.exe	82
3220	668	WerFault.exe	91
4860	2800	WerFault.exe	82
4136	668	WerFault.exe	91
2376	2800	WerFault.exe	82
4272	668	WerFault.exe	91
3576	2800	WerFault.exe	82
1620	668	WerFault.exe	91
3680	2800	WerFault.exe	82
1752	668	WerFault.exe	91
4600	2800	WerFault.exe	82
4696	668	WerFault.exe	91
3952	668	WerFault.exe	91
3364	668	WerFault.exe	91
5096	668	WerFault.exe	91
388	668	WerFault.exe	91
2616	668	WerFault.exe	91
4684	668	WerFault.exe	91
2532	668	WerFault.exe	91
4900	668	WerFault.exe	91
4420	2800	WerFault.exe	82
4412	2800	WerFault.exe	82
1260	668	WerFault.exe	91
4776	668	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
Token: SeDebugPrivilege	668	nEbMdKo17902.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
668	nEbMdKo17902.exe
668	nEbMdKo17902.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 668	2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe	91
PID 2800 wrote to memory of 668	2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe	91
PID 2800 wrote to memory of 668	2800	44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 220
  2⤵
  - Program crash
  PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 552
  2⤵
  - Program crash
  PID:4360
- C:\ProgramData\nEbMdKo17902\nEbMdKo17902.exe
  "C:\ProgramData\nEbMdKo17902\nEbMdKo17902.exe" "C:\Users\Admin\AppData\Local\Temp\44b317f22e4f8b434457bd4e716ffcdf_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 220
    3⤵
    - Program crash
    PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 728
    3⤵
    - Program crash
    PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 732
    3⤵
    - Program crash
    PID:3220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 732
    3⤵
    - Program crash
    PID:4136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 812
    3⤵
    - Program crash
    PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 820
    3⤵
    - Program crash
    PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 980
    3⤵
    - Program crash
    PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1028
    3⤵
    - Program crash
    PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1200
    3⤵
    - Program crash
    PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1384
    3⤵
    - Program crash
    PID:3364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1596
    3⤵
    - Program crash
    PID:5096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 928
    3⤵
    - Program crash
    PID:388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 636
    3⤵
    - Program crash
    PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1672
    3⤵
    - Program crash
    PID:4684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1784
    3⤵
    - Program crash
    PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1792
    3⤵
    - Program crash
    PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1136
    3⤵
    - Program crash
    PID:1260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 796
    3⤵
    - Program crash
    PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 616
  2⤵
  - Program crash
  PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 792
  2⤵
  - Program crash
  PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 792
  2⤵
  - Program crash
  PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 792
  2⤵
  - Program crash
  PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 824
  2⤵
  - Program crash
  PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 952
  2⤵
  - Program crash
  PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1028
  2⤵
  - Program crash
  PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1200
  2⤵
  - Program crash
  PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 640
  2⤵
  - Program crash
  PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 140
  2⤵
  - Program crash
  PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2800 -ip 2800
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2800 -ip 2800
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2800 -ip 2800
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 668 -ip 668
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2800 -ip 2800
1⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 668 -ip 668
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2800 -ip 2800
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 668 -ip 668
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2800 -ip 2800
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 668 -ip 668
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2800 -ip 2800
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 668 -ip 668
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2800 -ip 2800
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 668 -ip 668
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2800 -ip 2800
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 668 -ip 668
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2800 -ip 2800
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 668 -ip 668
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 668 -ip 668
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 668 -ip 668
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 668 -ip 668
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 668 -ip 668
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 668 -ip 668
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 668 -ip 668
1⤵
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 668 -ip 668
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 668 -ip 668
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2800 -ip 2800
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2800 -ip 2800
1⤵
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 668 -ip 668
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 668 -ip 668
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nEbMdKo17902\nEbMdKo17902.exe

Filesize
354KB

MD5
29ad9c5113257be232e642d1b940495b

SHA1
48d749c348a700d0c8a30d384eb10efc05214918

SHA256
79d5f729fc7907d2e84e990472cf786493252acc4f4d3434e3be8e2b724e6eac

SHA512
8cbbadbcb2db03fb385be19426a7b0f48339774f84afa02e8171ec58eb16593c359c5943a46520153ff316446e264efece50ffb5d65b3a964e18b9390be745b1

Download Submit
memory/668-10-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/668-14-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/668-25-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2800-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2800-1-0x00000000773B3000-0x00000000773B4000-memory.dmp

Filesize
4KB

Download
memory/2800-13-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2800-32-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download