52899d685de4d3ddd9b16b3b1e07249d911d6dc07a3c0075a5508660536b8d1e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

742f7b86ee02ca8975d1d872b479204b_JaffaCakes118.exe
Size

132KB
MD5

742f7b86ee02ca8975d1d872b479204b
SHA1

5541cff408ba3312b8666c9a6b8fdf0af61635ac
SHA256

52899d685de4d3ddd9b16b3b1e07249d911d6dc07a3c0075a5508660536b8d1e
SHA512

8ca096b84ec57b89fe146810650eccabec41a958baca13360216c9834938da2f7b94a4152bcc533e83736600f267a5700d99ea06eafcb0f55b19378877c83990
SSDEEP

3072:obgtOA7IFQA3dKfPrTMpEWPF/2UWCmWQAnDaiPSTTGtU:obgR2QA3wWpWCm7AWYSTTGtU

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/808-0-0x0000000001000000-0x000000000104A000-memory.dmp	upx
behavioral2/memory/808-1-0x0000000001000000-0x000000000104A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	808	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	742f7b86ee02ca8975d1d872b479204b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\742f7b86ee02ca8975d1d872b479204b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\742f7b86ee02ca8975d1d872b479204b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 332
  2⤵
  - Program crash
  PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 808 -ip 808
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-0-0x0000000001000000-0x000000000104A000-memory.dmp

Filesize
296KB

Download
memory/808-1-0x0000000001000000-0x000000000104A000-memory.dmp

Filesize
296KB

Download