efcc3e0d27010b244563f684d50b801fc819f7359f477f36411fbc9afa112455

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe
Size

271KB
MD5

e839a7ebd4bf4a630749e04cf34e62ad
SHA1

12adba3923291f9d17fda545d7f9e112af184378
SHA256

efcc3e0d27010b244563f684d50b801fc819f7359f477f36411fbc9afa112455
SHA512

45b5e992d88f09b5b30e932f9cd20d40fbea10ecbb6f2a8ad6512de851787e42f778faef76eac478b47c4da53bf87e2e541d716217413a2652be22df872b8fb1
SSDEEP

6144:q+FNvDu5NMsd+mF9gNMrhsgRx2aHNs8DtD1SpUxo:lFxDAdMmF94KZJ+h

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2356	a21ca86013a6bb5e.exe

Executes dropped EXE 2 IoCs

pid	Process
2356	a21ca86013a6bb5e.exe
4836	a21ca86013a6bb5e.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2424-1-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-6-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2424-7-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-9-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-15-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-16-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-17-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-18-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-19-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-20-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-21-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-22-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-23-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-24-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-25-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-26-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-27-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-28-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-29-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-30-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-31-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-32-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-33-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-34-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-37-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-38-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-39-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-40-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-41-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-42-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/2356-43-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4836-44-0x0000000000400000-0x0000000000541000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a21ca86013a6bb5e.exe\""	a21ca86013a6bb5e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a21ca86013a6bb5e.exe\""	a21ca86013a6bb5e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a21ca86013a6bb5e.exe\""	a21ca86013a6bb5e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a21ca86013a6bb5e.exe\""	a21ca86013a6bb5e.exe

Program crash 20 IoCs

pid	pid_target	Process	procid_target
3876	2424	WerFault.exe	85
3956	2424	WerFault.exe	85
4036	2356	WerFault.exe	87
4052	4836	WerFault.exe	93
3908	2356	WerFault.exe	87
4500	2356	WerFault.exe	87
4360	2356	WerFault.exe	87
1100	2356	WerFault.exe	87
1620	2356	WerFault.exe	87
4796	2356	WerFault.exe	87
3100	2356	WerFault.exe	87
4092	2356	WerFault.exe	87
4088	2356	WerFault.exe	87
4164	2356	WerFault.exe	87
1492	2356	WerFault.exe	87
5036	2356	WerFault.exe	87
3268	2356	WerFault.exe	87
1640	2356	WerFault.exe	87
3152	2356	WerFault.exe	87
4984	4836	WerFault.exe	93

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2356	2424	e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe	87
PID 2424 wrote to memory of 2356	2424	e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe	87
PID 2424 wrote to memory of 2356	2424	e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe	87
PID 2356 wrote to memory of 4836	2356	a21ca86013a6bb5e.exe	93
PID 2356 wrote to memory of 4836	2356	a21ca86013a6bb5e.exe	93
PID 2356 wrote to memory of 4836	2356	a21ca86013a6bb5e.exe	93

C:\Users\Admin\AppData\Local\Temp\e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\a21ca86013a6bb5e.exe
  :*C:\Users\Admin\AppData\Local\Temp\e839a7ebd4bf4a630749e04cf34e62ad_JaffaCakes118.exe *
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\a21ca86013a6bb5e.exe
    a ZZZZZZXWUTG
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 616
      4⤵
      Program crash
      PID:4052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 636
      4⤵
      Program crash
      PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 632
    3⤵
    - Program crash
    PID:4036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 852
    3⤵
    - Program crash
    PID:3908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 900
    3⤵
    - Program crash
    PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 916
    3⤵
    - Program crash
    PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 924
    3⤵
    - Program crash
    PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1008
    3⤵
    - Program crash
    PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1008
    3⤵
    - Program crash
    PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1136
    3⤵
    - Program crash
    PID:3100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1540
    3⤵
    - Program crash
    PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1624
    3⤵
    - Program crash
    PID:4088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1556
    3⤵
    - Program crash
    PID:4164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1620
    3⤵
    - Program crash
    PID:1492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1796
    3⤵
    - Program crash
    PID:5036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1360
    3⤵
    - Program crash
    PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 864
    3⤵
    - Program crash
    PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 804
    3⤵
    - Program crash
    PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 144
  2⤵
  - Program crash
  PID:3876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 136
  2⤵
  - Program crash
  PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2424 -ip 2424
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2424 -ip 2424
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2356 -ip 2356
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4836 -ip 4836
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2356 -ip 2356
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2356 -ip 2356
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2356 -ip 2356
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2356 -ip 2356
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2356 -ip 2356
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2356 -ip 2356
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2356 -ip 2356
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2356 -ip 2356
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2356 -ip 2356
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2356 -ip 2356
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2356 -ip 2356
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2356 -ip 2356
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2356 -ip 2356
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2356 -ip 2356
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2356 -ip 2356
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4836 -ip 4836
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a21ca86013a6bb5e.exe

Filesize
271KB

MD5
9b6f998341a5f7eabfadc0aee8a44ce8

SHA1
2e285d8568552de38fabdf8509e10a9c18deb7dc

SHA256
2e93ac3bf454c5b817157a7b60e1aad44a2952ca2a74fb2fa517afa4b0af6e44

SHA512
973d30b5c79d34a96c2fada56b047d08ec190fc6a0ead9ead74399dda38d5accb49ba4519e1eac93063d3bf7f446fbddd8a4cebbc7beaf881a01ce765d0d559b

Download Submit
memory/2356-25-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-27-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-6-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-43-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-41-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-15-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-39-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-17-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-37-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-19-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-33-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-21-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-31-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-23-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2356-29-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2424-0-0x0000000002700000-0x000000000272D000-memory.dmp

Filesize
180KB

Download
memory/2424-1-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2424-7-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-34-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-18-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-30-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-22-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-26-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-32-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-28-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-24-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-38-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-16-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-40-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-9-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-42-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-20-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4836-44-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads