Analysis

  • max time kernel
    138s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-08-2024 12:48

General

  • Target

    a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe

  • Size

    592KB

  • MD5

    a2979fe9cc6cdfef0f36e6079f11a0ef

  • SHA1

    f0d213befc2b617837f4c73e82f135a9b03bd1e9

  • SHA256

    f5e144e546913f82d4a09e7651d810acef969dccc81bf326aaae8cc9a2c3ce5a

  • SHA512

    7b6d2ecb46a06d48ce5959e2b83f17fa53eda20db5a719bc627f40f24dcbe9fd849ddc295f1fc010d6c474b3558bb65a7f33b2ff966597defa50bd8a10485661

  • SSDEEP

    6144:8CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr6:86TOUMBQf0ljW2vj7OyzoRaA+e

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2580
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3564
      • C:\Users\Admin\AppData\Local\Temp\a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 636
            4⤵
            • Program crash
            PID:4208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2112 -ip 2112
      1⤵
        PID:2444

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2112-9-0x00000000774B2000-0x00000000774B3000-memory.dmp

        Filesize

        4KB

      • memory/2112-8-0x0000000002950000-0x0000000002957000-memory.dmp

        Filesize

        28KB

      • memory/2112-5-0x0000000002950000-0x0000000002957000-memory.dmp

        Filesize

        28KB

      • memory/2112-19-0x00007FFF47050000-0x00007FFF47245000-memory.dmp

        Filesize

        2.0MB

      • memory/2112-17-0x0000000002950000-0x0000000002957000-memory.dmp

        Filesize

        28KB

      • memory/2112-12-0x00007FFF47050000-0x00007FFF47245000-memory.dmp

        Filesize

        2.0MB

      • memory/2580-15-0x00000000008F0000-0x00000000008F7000-memory.dmp

        Filesize

        28KB

      • memory/2580-20-0x00007FFF47270000-0x00007FFF47271000-memory.dmp

        Filesize

        4KB

      • memory/2580-16-0x00000000008F0000-0x00000000008F7000-memory.dmp

        Filesize

        28KB

      • memory/3564-11-0x00007FFF470ED000-0x00007FFF470EE000-memory.dmp

        Filesize

        4KB

      • memory/3564-23-0x00007FFF47260000-0x00007FFF47261000-memory.dmp

        Filesize

        4KB

      • memory/3564-10-0x00000000003C0000-0x00000000003C7000-memory.dmp

        Filesize

        28KB

      • memory/3564-22-0x00007FFF47280000-0x00007FFF47281000-memory.dmp

        Filesize

        4KB

      • memory/4652-2-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/4652-3-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/4652-1-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/4652-14-0x0000000000400000-0x0000000000404A00-memory.dmp

        Filesize

        18KB

      • memory/4652-0-0x0000000000410000-0x0000000000413000-memory.dmp

        Filesize

        12KB