Analysis
-
max time kernel
140s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
odoomv.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
odoomv.dll
Resource
win10v2004-20240802-en
General
-
Target
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
-
Size
249KB
-
MD5
91389828fe5ae5e5a96983826c0eb0d0
-
SHA1
cd21df962aada5660de39ea828fba2d9b1651041
-
SHA256
5e0414eddc6f66f187a13acfc42cd37568af9f904823e0bceebc5c7f451ea80a
-
SHA512
5c141d6764a853ab4236951ec5875425f8d2c052fb4d26841176d29762d7fcebb5ad914ab2ec317100c3a2c4f9be1d5434f6601125f992cc977f39f5faad4aa5
-
SSDEEP
6144:TqjI4LurUOZx18y+LFy5h7ZMhF7g3sj8+ccXt:O/LurdZx18ye0OG3k8Nc9
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exepid Process 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1448 4428 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exepid Process 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exedescription pid Process procid_target PID 4428 wrote to memory of 376 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 92 PID 4428 wrote to memory of 376 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 92 PID 4428 wrote to memory of 376 4428 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"2⤵PID:376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 10122⤵
- Program crash
PID:1448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4428 -ip 44281⤵PID:1524
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4260,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:81⤵PID:2172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
Filesize
23KB
MD5791b5b4e9636444923a03112bcd4de23
SHA1a99a6985a2cfa4ff2e9171cb330748da5054381d
SHA256d98f8a6e2fb2e874c80f8a974ff777d07d2bee075c8893e1e707b625fb6ec834
SHA512cc64c5a07f8b87718f5e86efa3261af9ee1bca74efab8c42ad13c07a2569b1b8e9402e47d0094bd62f9d16ab740733a833d96369d073c123d5386b7b148ff6a7