35eb2d9458b5cf967f2db1cadc8a71675d4205b4ce7b5f28e05d111e865340ad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 23:42

Target

3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe
Size

909KB
MD5

3d0feb3f0686dd409e054545835722aa
SHA1

b9bff64d671ef71a67cc3131c05c9bef39f0253c
SHA256

35eb2d9458b5cf967f2db1cadc8a71675d4205b4ce7b5f28e05d111e865340ad
SHA512

1608b8a0dd9f6cc190a27ef84d6cefdd59aad4de32d9a388cc3e5fd41e3dea0f9800d3170177e6af8e5b61d9c5f5a99ddf2d204c37e756bd2412adeac53085e8
SSDEEP

24576:oJgkwIT5ad3ssUkZG7FsaTvq4mAiXnnM82f:qwITgd3s1s8vNf

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe

pid process

264 3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4948 264 WerFault.exe 3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe

pid	process
264	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe

pid	pid_target	process	target process
4948	264	WerFault.exe	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe

description	pid	process	target process
PID 264 wrote to memory of 5080	264	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe
PID 264 wrote to memory of 5080	264	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe
PID 264 wrote to memory of 5080	264	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe	3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d0feb3f0686dd409e054545835722aa_JaffaCakes118.exe"
2⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 924
2⤵
- Program crash
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 264 -ip 264
1⤵
PID:3876

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nsb496F.tmp\System.dll
Filesize
11KB

MD5
55a26d7800446f1373056064c64c3ce8

SHA1
80256857e9a0a9c8897923b717f3435295a76002

SHA256
904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

SHA512
04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

Download Submit