Analysis

  • max time kernel
    138s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 20:29

General

  • Target

    a819ddbd68bb5475306ab51ff88823e1_JaffaCakes118.exe

  • Size

    4.6MB

  • MD5

    a819ddbd68bb5475306ab51ff88823e1

  • SHA1

    37d74d4e55bf91bcbe9b82c5f228ac80fb967c08

  • SHA256

    115a710980ec531ae5e57b4bb04ece52e55f62a98c0795065bc74b32e79179dc

  • SHA512

    2cbae765f88824bb22140dde01a1cfa39b466739c65fe849ddf0e7cd93292d4e537cb8438d9fa3758b7db7b06596fd9dbc9ed5e36bf436fdc658d626a6378ec7

  • SSDEEP

    98304:B+87faRFefNvPDXpqpB1MqIAtJ4Bqbh85QsCJWmQq4KQc7EOsAT8O8O2Sc:BxjeIrUpB1MqFtJ4Bqbh85QsCJWmQq47

Score
7/10

Malware Config

Signatures

  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a819ddbd68bb5475306ab51ff88823e1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a819ddbd68bb5475306ab51ff88823e1_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1360
      2⤵
      • Program crash
      PID:640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1360
      2⤵
      • Program crash
      PID:1216
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2504 -ip 2504
    1⤵
      PID:3844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2504 -ip 2504
      1⤵
        PID:3644

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2504-2-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-0-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-12-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-50-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-49-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-48-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-42-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-40-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-26-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-18-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-14-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-8-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-47-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-44-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-6-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-36-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-35-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-33-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-30-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-5-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-29-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-25-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-22-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-20-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-16-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-10-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-3-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-4-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/2504-51-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB