ced8ef0467315d3fa3ed4b2ae864c9387d9ff6d70446a966af0b8fe85b217376

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe
Size

204KB
MD5

96475d679cc3df6c296b4474016faf7a
SHA1

d0ade86016f2dd9cf88b97ddfa99084325ed3a2f
SHA256

ced8ef0467315d3fa3ed4b2ae864c9387d9ff6d70446a966af0b8fe85b217376
SHA512

9015d6b638173c333163f5868b976e6f55caddcd21bf0fd9a615952559e90f1b5b3ead318e5949f52dbc34a782be3981b9a3565f51efcc20ef3b8ec30f372f6e
SSDEEP

6144:JflNsD4EgQ/wlY0xVycfDyqMiRhxDzZpQ8SaNctTZaxdfZY:J4fgQSzPhHHu5aeaxhZY

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4236	96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	4236	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4236	96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96475d679cc3df6c296b4474016faf7a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 616
  2⤵
  - Program crash
  PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4236 -ip 4236
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sshnas21.dll

Filesize
169KB

MD5
c5a428c9b2a25a2cd434cc46d831cf2d

SHA1
42cfe8d761d8170f80b2685bd7cfe9106b7456cd

SHA256
087bd4a69bb18b2a08bb6bb96ee7ea47016f79779bc5d0717cb703657d9532f9

SHA512
f304e06a883f8982937218926551cddb18a51673de950c35543d36380daf68f7e108dd905eee617145679d8f022b87a8e62133eb4505de9ae69064ef54a43813

Download Submit
memory/4236-0-0x00000000021E0000-0x0000000002202000-memory.dmp

Filesize
136KB

Download
memory/4236-1-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/4236-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4236-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4236-10-0x00000000021B0000-0x00000000021DE000-memory.dmp

Filesize
184KB

Download