Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 13:57
Behavioral task
behavioral1
Sample
a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
-
Size
282KB
-
MD5
a2ce6e650a6aa090d2b6411cb8599125
-
SHA1
5cb36dcad74c647e597d0a74fa605842da6a43d8
-
SHA256
6fba99be7371090f81077cbe3d679d57d27682d52ef96c8d962619add2170b4e
-
SHA512
507394d3d13c1be69b110245ad46206d2bcbae3c9a7dad32d79a791c2c4904674723b72337ee56d49d6eab7d04f2c9a729e7817190a2631a2f5ebf36b7bfd936
-
SSDEEP
6144:Dcu2JbDktc0z0FM3SybA5U7L0tIV2jq42hgN96VQ8VkmHC9E2:DSbQcg0FGS0LeIV2WDaR8V/l
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000a0000000234df-2.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1204 G_Server2007 -
Loads dropped DLL 2 IoCs
pid Process 1204 G_Server2007 1204 G_Server2007 -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\RAV2007.BAT a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe File created C:\Windows\G_Server2007 a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe File opened for modification C:\Windows\G_Server2007 a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe File created C:\Windows\G_Server2007.DLL G_Server2007 File opened for modification C:\Windows\G_Server2007.DLL G_Server2007 -
Program crash 2 IoCs
pid pid_target Process procid_target 3692 4928 WerFault.exe 83 1608 1204 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language G_Server2007 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1204 G_Server2007 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1204 G_Server2007 1204 G_Server2007 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4756 4928 a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe 93 PID 4928 wrote to memory of 4756 4928 a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe 93 PID 4928 wrote to memory of 4756 4928 a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 3762⤵
- Program crash
PID:3692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\RAV2007.BAT2⤵
- System Location Discovery: System Language Discovery
PID:4756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 49281⤵PID:4768
-
C:\Windows\G_Server2007C:\Windows\G_Server20071⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 3762⤵
- Program crash
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1204 -ip 12041⤵PID:1832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
282KB
MD5a2ce6e650a6aa090d2b6411cb8599125
SHA15cb36dcad74c647e597d0a74fa605842da6a43d8
SHA2566fba99be7371090f81077cbe3d679d57d27682d52ef96c8d962619add2170b4e
SHA512507394d3d13c1be69b110245ad46206d2bcbae3c9a7dad32d79a791c2c4904674723b72337ee56d49d6eab7d04f2c9a729e7817190a2631a2f5ebf36b7bfd936
-
Filesize
236KB
MD5aabc0dda6829aa3b104981fb03de696c
SHA127cf8b007f9ff5d29e0e6158932dd342d49f4d60
SHA256c395e2c651859727d8ad410fc10dd06e1e6feebf9dcaa02543fe1c0106239cc8
SHA512a6a58394f19c35aed17d9d7c8137925fa3a539d0f189d94932eb13de313d5e6657fe715b25f5e9799a4295bf673b99c7519847c2523810ad2dc5394b89e11747
-
Filesize
218B
MD58c592163dfd82fc176d379d605fae6ba
SHA1ca5c0f8c447d7f994c0baa929fb66139de9c497f
SHA25699cd6d04422631e816aa1b9da054488dc75680ded973b9b6bca6f1c7dca4cd9f
SHA512149f24d3e1ff3f4c3124ea506342ab6bacab3cabe3df0dccd6944b8b772b052de6ae0d2e1ded326f5740a6bebf2f78dbad8b79cd073bfb1276f2493e5161a175