1330c7c0fb50c155dc57cc2ae786f9c73007b1b3ef1ab54fd49a32f2871aff67

Analysis

max time kernel
130s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe
Size

32KB
MD5

ae9811f3c231cf718783e2593c6b5182
SHA1

b439b8652b47aff81bcfc7ae1b84064d35fb9857
SHA256

1330c7c0fb50c155dc57cc2ae786f9c73007b1b3ef1ab54fd49a32f2871aff67
SHA512

0091deb909b8f3bde16aa8d46bb072587acf4dab2b946f824f33f2a8f63b21100ea19a9e9ec89a0bbb469adcfc4a7ae0083f1a5d5b7fe5fb1c3277cef1e16362
SSDEEP

384:f98xUHQl/sT5ayOny4/q8zLeiEerLkWYga/lIhDtrzt/nOGTEi7pg:WwvInBqopHxYxIhDtrztvO0g

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 1268	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	1268	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2548	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe
468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2548	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	85
PID 468 wrote to memory of 2548	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	85
PID 468 wrote to memory of 2548	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	85
PID 468 wrote to memory of 1268	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	90
PID 468 wrote to memory of 1268	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	90
PID 468 wrote to memory of 1268	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	90
PID 468 wrote to memory of 1268	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	90
PID 468 wrote to memory of 1268	468	ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ae9811f3c231cf718783e2593c6b5182_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2548
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 12
    3⤵
    - Program crash
    PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1268 -ip 1268
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

Filesize
166B

MD5
f44153ef26be29552cf320325ad8b72e

SHA1
74ac72ba2ff0f871e59b11c95ad707372662370c

SHA256
767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f

SHA512
1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65

Download Submit
C:\Users\Admin\AppData\Local\WinHttp.exe

Filesize
32KB

MD5
b8eb4cda469d2326ba4af07dd84cbc34

SHA1
40d3508020ee0d739160be269dba6d1350f509a1

SHA256
e5b1aee8fe638fc2c7f6c79c01702376959d1877ff5ae44ff2ed8336a6469b33

SHA512
f865ff50e6ddd6cee7d40d5dbdd9ae7dd27ed9f098da7a6d355e8570e94c8cd26eba4b2e1450fedbcafd87fada004b1d06abb07b60069a03e2c0fd362b80853b

Download Submit
memory/468-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/468-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1268-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads