Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 08:17
Behavioral task
behavioral1
Sample
8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe
-
Size
14KB
-
MD5
8dfda245ae054f636ba58ab837404194
-
SHA1
3d69df2b52ece7f8244aacc16a5cc5b7edc446f3
-
SHA256
7a07469248f8ba596187821021844bcde2e625bb9177338940bcc412565c4edc
-
SHA512
99c1eb6f57ee457a71ba5157e5a2d8f4d0939b39eb90ac2eeb45faa3945e51480fd47c1459d45359a767dc2079c3541473aca55fb24f48cc2118855f1c1ca274
-
SSDEEP
192:vskq35p04P58YREnioSKnLKPy/kRuK5gkoNVeBSb0PEyncjWOS7E25Qg57Qe2Sss:vy/7R8nNLz/25gkOYBSYtnP7EEQZIp
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1292-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/1292-13-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1152 1292 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main 8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.extremeaccess.info/?rid=4" 8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 11242⤵
- Program crash
PID:1152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1292 -ip 12921⤵PID:4696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD575edce8ec3fb231917dbaf8b20137dc4
SHA1a257a254c3ea326280aefd7541b00a6d1c0b176e
SHA256d5b98df96c3ca051567a186b69f15eecf87423a51e5726160d1fe6b79b8d23a6
SHA51237ea90bc54ca3a73c674fbc24b01b922914a92ad46bf959478043f089b9c9406a2c61ecb3cb422911742ed2b063db134434fa755e598841f8ef86ee36aaad8b9