25eba4c8d76972fd240579e23a1261dfb389f434790e46c549aa1429b417b017

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9594d4bf8701c4c0a6a5081dabd7cfef_JaffaCakes118.exe
Size 17KB
Sample240814-ltl9qszgrj
SHA256 25eba4c8d76972fd240579e23a1261dfb389f434790e46c549aa1429b417b017
MD5 9594d4bf8701c4c0a6a5081dabd7cfef
SHA1 9ff95dabdf0fe9ef73d5fdc57a06a410650aecbe
SHA512 d9cf0a911a79d763a7b1ecbf57754382820f17ec2ddbf8d7168b21b3cd550560e885aa5543ffd5f6fcb4db26f9351dbd07348e9250d32eab61f14db47a88d80a
SSDEEP 384:Al8kcNKFYVdO0ILejUw9qFDlcWvqyZDtdlcu/Qb3K:Al87NAYVw3Lejh9qleWvRLlcT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4784-0-0x0000000000400000-0x0000000000912000-memory.dmp	upx
behavioral2/memory/4784-1-0x0000000000400000-0x0000000000912000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	4784	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9594d4bf8701c4c0a6a5081dabd7cfef_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9594d4bf8701c4c0a6a5081dabd7cfef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9594d4bf8701c4c0a6a5081dabd7cfef_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 288
  2⤵
  - Program crash
  PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4784 -ip 4784
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4784-0-0x0000000000400000-0x0000000000912000-memory.dmp

Download

memory/4784-1-0x0000000000400000-0x0000000000912000-memory.dmp