28f1940e63b6fde028dd1ae55979296daa4f7b081df5e3e251b7f98825415a86

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 14:31

Target

4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe
Size

30KB
MD5

4638a4e7faf5a9343551cc6e9668d143
SHA1

285ac0fb341e57c87964282f621b3d1f018ab7ea
SHA256

28f1940e63b6fde028dd1ae55979296daa4f7b081df5e3e251b7f98825415a86
SHA512

ecfb581b9f6e074cb0c5d241fe10ac56882ce96cde3a7375791c809948081e73fb185130e89180cd057c7e8a9a9675d036d844177e957f907d1fc06b5c7a900c
SSDEEP

768:gpB8zue2cyohIGl2DoLJHq01WZIVVPhRSe6oA:xisIaLJKkI0RhY

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4044	1164	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe
1164	4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3448	1164	4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe	86
PID 1164 wrote to memory of 3448	1164	4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe	86
PID 1164 wrote to memory of 3448	1164	4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4638a4e7faf5a9343551cc6e9668d143_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\682D.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\4638A4~1.EXE"
  2⤵
  PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 856
  2⤵
  - Program crash
  PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1164 -ip 1164
1⤵
PID:4004

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\682D.tmp.cmd

Filesize
127B

MD5
44143e15ec7c2bf219399f280e1f08a2

SHA1
911ed806fd6af2efacefc136b78c5485ff693dd4

SHA256
6db594e88f9cd6963ba8685c247d4fb4ef2239e8f8f3a65d9e80fd02586d26ea

SHA512
08844c4b77c161ee5532d7f9cb74cdfe59e4941d2fde0669ca007d970b8973746d293e8ed899d7d2e90707da975ae98454ecbcbc88dbe7c520fef1cab37b755a

Download Submit
memory/1164-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1164-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download