Analysis

  • max time kernel
    140s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 02:13

General

  • Target

    91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe

  • Size

    249KB

  • MD5

    91389828fe5ae5e5a96983826c0eb0d0

  • SHA1

    cd21df962aada5660de39ea828fba2d9b1651041

  • SHA256

    5e0414eddc6f66f187a13acfc42cd37568af9f904823e0bceebc5c7f451ea80a

  • SHA512

    5c141d6764a853ab4236951ec5875425f8d2c052fb4d26841176d29762d7fcebb5ad914ab2ec317100c3a2c4f9be1d5434f6601125f992cc977f39f5faad4aa5

  • SSDEEP

    6144:TqjI4LurUOZx18y+LFy5h7ZMhF7g3sj8+ccXt:O/LurdZx18ye0OG3k8Nc9

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"
      2⤵
        PID:376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1012
        2⤵
        • Program crash
        PID:1448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4428 -ip 4428
      1⤵
        PID:1524
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4260,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
        1⤵
          PID:2172

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsy1B73.tmp\System.dll

          Filesize

          11KB

          MD5

          fccff8cb7a1067e23fd2e2b63971a8e1

          SHA1

          30e2a9e137c1223a78a0f7b0bf96a1c361976d91

          SHA256

          6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

          SHA512

          f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

        • C:\Users\Admin\AppData\Local\Temp\odoomv.dll

          Filesize

          23KB

          MD5

          791b5b4e9636444923a03112bcd4de23

          SHA1

          a99a6985a2cfa4ff2e9171cb330748da5054381d

          SHA256

          d98f8a6e2fb2e874c80f8a974ff777d07d2bee075c8893e1e707b625fb6ec834

          SHA512

          cc64c5a07f8b87718f5e86efa3261af9ee1bca74efab8c42ad13c07a2569b1b8e9402e47d0094bd62f9d16ab740733a833d96369d073c123d5386b7b148ff6a7

        • memory/4428-10-0x0000000074950000-0x000000007495A000-memory.dmp

          Filesize

          40KB

        • memory/4428-11-0x0000000074950000-0x000000007495A000-memory.dmp

          Filesize

          40KB