847679333f5713fbddcbc9069c7e28ea849c8ed577e82e26831b05f8837130f7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe
Size

270KB
MD5

72eb859b75f4690450e4c7306081d43f
SHA1

385f96650c2d4f88549a0a5c2f1293d16083359a
SHA256

847679333f5713fbddcbc9069c7e28ea849c8ed577e82e26831b05f8837130f7
SHA512

9e4c61046bea2018e7c7e9459cea1e4f88e6bc1d8fc40abab0f49e920e7b6f7f750c1436777ec50467e6299dc51320bc23038e911d0331d82e50380ecaffa35f
SSDEEP

6144:oYK6CelYy8GlTUfKJ4mggzriFp0oFWZatBXDmkJZgd:oYK6CelYy8GlTUfKJAgzriFBFWobDmku

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1884	72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe
1884	72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_ProxyM.dll	72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\_Proxy.dll	72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
436	1884	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72eb859b75f4690450e4c7306081d43f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 532
  2⤵
  - Program crash
  PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1884 -ip 1884
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\_Proxy.dll

Filesize
10KB

MD5
5c414f6567285a88cf9f920065f8d3d8

SHA1
a19789abeb6ac40f52a3f1ead79b1a59cdfef0c0

SHA256
b3046854e0702348b4b7f5820d38fda9e78b6fdf498b87c00b251580aa9f77a2

SHA512
e37a5bef26caba346a19a74b8b614699115d2ff913fd6a7ee045e40ed4314a43a039fcdc1595d692193ad61afcade535aa0f1c76210eec365c2d5fa91556c635

Download Submit
memory/1884-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1884-8-0x0000000000190000-0x0000000000193000-memory.dmp

Filesize
12KB

Download
memory/1884-6-0x0000000000190000-0x0000000000193000-memory.dmp

Filesize
12KB

Download
memory/1884-10-0x0000000000190000-0x0000000000193000-memory.dmp

Filesize
12KB

Download
memory/1884-12-0x0000000000190000-0x0000000000193000-memory.dmp

Filesize
12KB

Download
memory/1884-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download