Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-05-2024 09:53

General

  • Target

    123122425086ff149c20d1657799ba57_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    123122425086ff149c20d1657799ba57

  • SHA1

    343f01cb713052ba16957c30a8cbf4a24727fa67

  • SHA256

    907a071a0c75228b0a485fbe8dee4cd89574cf673ab466cc022fd0c10610fdad

  • SHA512

    4b33362a377270d884efd76b92f0fe3c81cbcced85e2f873cffeff52e4464dc99b9d254870d8eeff897a18a21c685baa6c7006772584491247852d3b362a5093

  • SSDEEP

    24576:vbyOd1mBlZPRZCTX0oJ6YFUQoJJOyq0BYtach8mS8:v+O0ZPnCD56YF+J4h0BYtLhA8

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123122425086ff149c20d1657799ba57_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\123122425086ff149c20d1657799ba57_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\123122425086ff149c20d1657799ba57_JaffaCakes118.exe":ZONE.identifier & exit
      2⤵
      • NTFS ADS
      PID:2624
    • C:\Users\Admin\AppData\Local\Temp\123122425086ff149c20d1657799ba57_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\123122425086ff149c20d1657799ba57_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      PID:2824
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 448
        3⤵
        • Program crash
        PID:3908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2824 -ip 2824
    1⤵
      PID:1160

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\123122425086ff149c20d1657799ba57_JaffaCakes118.exe

      Filesize

      1.3MB

      MD5

      123122425086ff149c20d1657799ba57

      SHA1

      343f01cb713052ba16957c30a8cbf4a24727fa67

      SHA256

      907a071a0c75228b0a485fbe8dee4cd89574cf673ab466cc022fd0c10610fdad

      SHA512

      4b33362a377270d884efd76b92f0fe3c81cbcced85e2f873cffeff52e4464dc99b9d254870d8eeff897a18a21c685baa6c7006772584491247852d3b362a5093

    • memory/2824-15-0x0000000000400000-0x0000000000563000-memory.dmp

      Filesize

      1.4MB

    • memory/2824-21-0x0000000000400000-0x0000000000563000-memory.dmp

      Filesize

      1.4MB

    • memory/2824-24-0x0000000000400000-0x0000000000563000-memory.dmp

      Filesize

      1.4MB

    • memory/2824-26-0x0000000000C60000-0x0000000000C61000-memory.dmp

      Filesize

      4KB

    • memory/2824-25-0x0000000000400000-0x0000000000563000-memory.dmp

      Filesize

      1.4MB

    • memory/2824-17-0x0000000000400000-0x0000000000563000-memory.dmp

      Filesize

      1.4MB

    • memory/2824-16-0x0000000000400000-0x0000000000563000-memory.dmp

      Filesize

      1.4MB

    • memory/4284-0-0x0000000074622000-0x0000000074623000-memory.dmp

      Filesize

      4KB

    • memory/4284-1-0x0000000074620000-0x0000000074BD1000-memory.dmp

      Filesize

      5.7MB

    • memory/4284-2-0x0000000074620000-0x0000000074BD1000-memory.dmp

      Filesize

      5.7MB

    • memory/4284-29-0x0000000074620000-0x0000000074BD1000-memory.dmp

      Filesize

      5.7MB