c5439fd5d68636c4f2ec073060bbda129ca3617d83e5548e2884b2e44f986a70

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe
Size

264KB
MD5

a35da464fd7d4c0495991c6f744c5eae
SHA1

f4d4cfd014ec6c355124f1e5bb7403b6687d98e8
SHA256

c5439fd5d68636c4f2ec073060bbda129ca3617d83e5548e2884b2e44f986a70
SHA512

2ad0fc42438278111a3ff790f264c037cb14a6fe01aae62d0d45f00d9dcf496b99bd394cc48e370b569dd825c73c6d089f0e12e0a7a2b83348742b0a7af29226
SSDEEP

6144:HxVOxPmUh+maCnJU8p0wc1E8ripaBOl+JmozsJlI/OQrSOJ:HxVOhhXrrgBK7ozKlGP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4128	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	4128	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	server.exe
4128	server.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4128	4340	a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe	84
PID 4340 wrote to memory of 4128	4340	a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe	84
PID 4340 wrote to memory of 4128	4340	a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 556
    3⤵
    - Program crash
    PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CRYEXE.EXE

Filesize
42KB

MD5
e238ceefc323be98185d0cf2834962d2

SHA1
99d1697cbb6bd6df2685b506e81d0f3b9e8c496a

SHA256
0e1e13dd4fa565a0dec031ff4ef9a3ddedf2e84443b6f68a95e727cf3d114d28

SHA512
4e7c9a3166edc9780c243a26ca434ad83b1f6f261179074ede49d7014f0b8e3288208909bf5d7afd106b71cd5da2c4015bf03b9bd7a85965e28d2d873bf1cfd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
60KB

MD5
cd76d2cf6bc30a0a7ec6bca215707d53

SHA1
9e23a9a03e3f17e111bb12b8691c0338be3c20d0

SHA256
82a12e6723aee9b22c82dd21df3c3aa60786d051e8366bcbced6385c4d2a8709

SHA512
25e5e8eeca077f90038a6b593c97a6488b024cade84edd814b538d86b20557b33085647b731d3770160ec1b343365b341fa5d13c0c3da2fd6d840b48890a2ade

Download Submit
memory/4340-0-0x0000000001001000-0x0000000001003000-memory.dmp

Filesize
8KB

Download
memory/4340-1-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download
memory/4340-4-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download
memory/4340-2-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download
memory/4340-9-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download
memory/4340-18-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download