ea5e0925be72cbf6902f0a78494611e2ed4356a8bc03b02a165997a527d60331

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe
Size

317KB
MD5

4adfdc059136ebf94d5396baf9e91ef5
SHA1

e5ee06446f1ffa5720990c1d836f6d10512439ab
SHA256

ea5e0925be72cbf6902f0a78494611e2ed4356a8bc03b02a165997a527d60331
SHA512

d0b9a236c49674abd2f693951acfa21fff603942ee20efb81c2076d72e9096442aaf1c4043e8a092fd15e2a9199959079e73b55b2343758675afbc733393fb29
SSDEEP

6144:davERPh5qe7/JFB7XYdjSYGioU8DmiUtH:dNRP2e7/JFTD1UtH

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2560	gHmBnNi01819.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	gHmBnNi01819.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/664-2-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/664-3-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/664-5-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2560-19-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2560-18-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/664-22-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2560-23-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/2560-34-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/664-41-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gHmBnNi01819 = "C:\\ProgramData\\gHmBnNi01819\\gHmBnNi01819.exe"	gHmBnNi01819.exe

Program crash 25 IoCs

pid	pid_target	Process	procid_target
4092	664	WerFault.exe	82
1376	2560	WerFault.exe	86
3880	664	WerFault.exe	82
1296	2560	WerFault.exe	86
3952	664	WerFault.exe	82
3460	2560	WerFault.exe	86
60	664	WerFault.exe	82
1200	2560	WerFault.exe	86
4124	664	WerFault.exe	82
1224	2560	WerFault.exe	86
2464	664	WerFault.exe	82
2992	2560	WerFault.exe	86
4496	664	WerFault.exe	82
4944	2560	WerFault.exe	86
3532	2560	WerFault.exe	86
3496	2560	WerFault.exe	86
4628	2560	WerFault.exe	86
4448	2560	WerFault.exe	86
2096	2560	WerFault.exe	86
3036	2560	WerFault.exe	86
3808	2560	WerFault.exe	86
4488	664	WerFault.exe	82
936	664	WerFault.exe	82
3976	2560	WerFault.exe	86
2300	2560	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe
Token: SeDebugPrivilege	2560	gHmBnNi01819.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2560	gHmBnNi01819.exe
2560	gHmBnNi01819.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2560	gHmBnNi01819.exe
2560	gHmBnNi01819.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2560	gHmBnNi01819.exe
2560	gHmBnNi01819.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2560	664	4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe	86
PID 664 wrote to memory of 2560	664	4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe	86
PID 664 wrote to memory of 2560	664	4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\ProgramData\gHmBnNi01819\gHmBnNi01819.exe
  "C:\ProgramData\gHmBnNi01819\gHmBnNi01819.exe" "C:\Users\Admin\AppData\Local\Temp\4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 768
    3⤵
    - Program crash
    PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 776
    3⤵
    - Program crash
    PID:1296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 776
    3⤵
    - Program crash
    PID:3460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 828
    3⤵
    - Program crash
    PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 936
    3⤵
    - Program crash
    PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 992
    3⤵
    - Program crash
    PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 988
    3⤵
    - Program crash
    PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1388
    3⤵
    - Program crash
    PID:3532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1600
    3⤵
    - Program crash
    PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 924
    3⤵
    - Program crash
    PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1592
    3⤵
    - Program crash
    PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1632
    3⤵
    - Program crash
    PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1788
    3⤵
    - Program crash
    PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1796
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1120
    3⤵
    - Program crash
    PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 792
    3⤵
    - Program crash
    PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 624
  2⤵
  - Program crash
  PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 792
  2⤵
  - Program crash
  PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 792
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 844
  2⤵
  - Program crash
  PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 852
  2⤵
  - Program crash
  PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1000
  2⤵
  - Program crash
  PID:2464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1036
  2⤵
  - Program crash
  PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 644
  2⤵
  - Program crash
  PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 140
  2⤵
  - Program crash
  PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 664 -ip 664
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2560 -ip 2560
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 664 -ip 664
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2560 -ip 2560
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 664 -ip 664
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2560 -ip 2560
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 664 -ip 664
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2560 -ip 2560
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 664 -ip 664
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2560 -ip 2560
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 664 -ip 664
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2560 -ip 2560
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 664 -ip 664
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2560 -ip 2560
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2560 -ip 2560
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2560 -ip 2560
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2560 -ip 2560
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2560 -ip 2560
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 2560 -ip 2560
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2560 -ip 2560
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2560 -ip 2560
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 664 -ip 664
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 664 -ip 664
1⤵
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2560 -ip 2560
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2560 -ip 2560
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\gHmBnNi01819\gHmBnNi01819.exe

Filesize
317KB

MD5
20cbce04c86a31f0f319632eaf431829

SHA1
1a7db32c6b45ba639994dd49e097d6c764374016

SHA256
29737b2a9b1df84b2b2e1929ada791ddc56652efd52e6754e08ecd821145a339

SHA512
fb73c26c4e0d6ebd21867df506e99fc9829c8741c29ddd4eef0a4ca8bdc2026074127d3bafd3a489548c065cf31e490ea6bdc26f9e9ee23ef665c749d65a6b90

Download Submit
memory/664-22-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/664-3-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/664-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/664-4-0x0000000000468000-0x00000000004B1000-memory.dmp

Filesize
292KB

Download
memory/664-2-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/664-0-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/664-41-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2560-14-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2560-19-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2560-18-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2560-23-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2560-34-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads