6c205bfd7c690efdd883534f2c2bbc7284d9d8671d22e95c65ea7f40f3c7eeab

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe
Size

179KB
MD5

5e7a8c4100fc9f6ca2184d0dde0c93ce
SHA1

d5a3c5c185c77c96b2049dbce33efb76f1936019
SHA256

6c205bfd7c690efdd883534f2c2bbc7284d9d8671d22e95c65ea7f40f3c7eeab
SHA512

1aeaf3a032d520d0585174f9ef2e115b689099e86bfad274c0dcc225fafb16393d21d63a0d12b60543adc2d1736f7ad3f3d811915e95077f05b2d8c839f63517
SSDEEP

3072:by3UTxRQE8TsD2iM6mwAnxxAsJFk436kBizcXZLMXMACV7bZhlH26wb/1bf:bKrstfX+xxPJF8kB5XVKLEbtBwb1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000400000-0x000000000045F000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
74904	5076	WerFault.exe	83

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5076	5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e7a8c4100fc9f6ca2184d0dde0c93ce_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 624
  2⤵
  - Program crash
  PID:74904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5076 -ip 5076
1⤵
PID:74804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5076-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/5076-1-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/5076-4-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5076-61509-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5076-61511-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download