931cd4663a26b8a9259d22c398436be1da8238e2187a4a89cc29a46e28876c83

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe
Size

317KB
MD5

2e38d3e24043a384dde81ec0bd90165c
SHA1

404eb37f4911f31b4c3acc80476d46149c43e99e
SHA256

931cd4663a26b8a9259d22c398436be1da8238e2187a4a89cc29a46e28876c83
SHA512

429ada61315c45902e7cec60e9eb640ccfc81895bc7309711080a944e15561b1e09e29073885f0ddb6bc801de3335ea3e29eed2c0ec2b32271d938274911c4cc
SSDEEP

6144:jgvB8U3GLsvCjuVwg6ndXmgjGNUYYAleJGWS4blVJRsjTMEjN2ndh:jsqsUuVYndXm6ntAezS+RsjYv

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
736	nNgNmJd06510.exe

Executes dropped EXE 1 IoCs

pid	Process
736	nNgNmJd06510.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2620-2-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2620-3-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2620-5-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/736-18-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2620-21-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/736-22-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/736-34-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2620-41-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nNgNmJd06510 = "C:\\ProgramData\\nNgNmJd06510\\nNgNmJd06510.exe"	nNgNmJd06510.exe

Program crash 26 IoCs

pid	pid_target	Process	procid_target
4272	2620	WerFault.exe	81
884	2620	WerFault.exe	81
224	736	WerFault.exe	85
1988	736	WerFault.exe	85
1432	2620	WerFault.exe	81
4176	736	WerFault.exe	85
1492	2620	WerFault.exe	81
3096	736	WerFault.exe	85
3640	2620	WerFault.exe	81
4856	736	WerFault.exe	85
3680	2620	WerFault.exe	81
1500	736	WerFault.exe	85
2304	2620	WerFault.exe	81
3004	736	WerFault.exe	85
2964	736	WerFault.exe	85
4876	736	WerFault.exe	85
1180	736	WerFault.exe	85
4576	736	WerFault.exe	85
720	736	WerFault.exe	85
4624	736	WerFault.exe	85
952	736	WerFault.exe	85
4536	736	WerFault.exe	85
4936	2620	WerFault.exe	81
4908	2620	WerFault.exe	81
4848	736	WerFault.exe	85
1536	736	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe
Token: SeDebugPrivilege	736	nNgNmJd06510.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
736	nNgNmJd06510.exe
736	nNgNmJd06510.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
736	nNgNmJd06510.exe
736	nNgNmJd06510.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
736	nNgNmJd06510.exe
736	nNgNmJd06510.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 736	2620	2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe	85
PID 2620 wrote to memory of 736	2620	2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe	85
PID 2620 wrote to memory of 736	2620	2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\ProgramData\nNgNmJd06510\nNgNmJd06510.exe
  "C:\ProgramData\nNgNmJd06510\nNgNmJd06510.exe" "C:\Users\Admin\AppData\Local\Temp\2e38d3e24043a384dde81ec0bd90165c_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 768
    3⤵
    - Program crash
    PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 776
    3⤵
    - Program crash
    PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 776
    3⤵
    - Program crash
    PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 800
    3⤵
    - Program crash
    PID:3096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 920
    3⤵
    - Program crash
    PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 992
    3⤵
    - Program crash
    PID:1500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1140
    3⤵
    - Program crash
    PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 988
    3⤵
    - Program crash
    PID:2964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1396
    3⤵
    - Program crash
    PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1608
    3⤵
    - Program crash
    PID:1180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 644
    3⤵
    - Program crash
    PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1596
    3⤵
    - Program crash
    PID:720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1640
    3⤵
    - Program crash
    PID:4624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1796
    3⤵
    - Program crash
    PID:952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1804
    3⤵
    - Program crash
    PID:4536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 640
    3⤵
    - Program crash
    PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 792
    3⤵
    - Program crash
    PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 624
  2⤵
  - Program crash
  PID:4272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 792
  2⤵
  - Program crash
  PID:884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 800
  2⤵
  - Program crash
  PID:1432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 800
  2⤵
  - Program crash
  PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 824
  2⤵
  - Program crash
  PID:3640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1000
  2⤵
  - Program crash
  PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1036
  2⤵
  - Program crash
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 644
  2⤵
  - Program crash
  PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 140
  2⤵
  - Program crash
  PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2620 -ip 2620
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 736 -ip 736
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2620 -ip 2620
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 736 -ip 736
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2620 -ip 2620
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 736 -ip 736
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2620 -ip 2620
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 736 -ip 736
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2620 -ip 2620
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 736 -ip 736
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2620 -ip 2620
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 736 -ip 736
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2620 -ip 2620
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 736 -ip 736
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 736 -ip 736
1⤵
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 736 -ip 736
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 736 -ip 736
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 736 -ip 736
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 736 -ip 736
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 736 -ip 736
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 736 -ip 736
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 736 -ip 736
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2620 -ip 2620
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2620 -ip 2620
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 736 -ip 736
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 736 -ip 736
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nNgNmJd06510\nNgNmJd06510.exe

Filesize
317KB

MD5
148fbd64d1596c10a1915dc3c99d529d

SHA1
dbaecb1e112d7b79972908d07c1b2784e89f104f

SHA256
47e551260f7955c86b8673d1279d6a48045e4bf12f539749846ec039a0c1fe9e

SHA512
39a731385d67786913531bf60eb73da1cc153e125d3b5d8d0f8b0167980e36d6a599a90bab0be1901949e5e67f2448a1d275a4d4af9b1ae0632781ca304c229a

Download Submit
memory/736-22-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/736-14-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/736-18-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/736-34-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2620-3-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2620-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2620-4-0x0000000000468000-0x00000000004B1000-memory.dmp

Filesize
292KB

Download
memory/2620-2-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2620-21-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2620-0-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2620-23-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2620-41-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads