594c467e38874bc9b39adfad370de12f425f17bcf8877b6175c113fa094b2ee4

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
Size

242KB
MD5

b406ba165b8500f3828687dcf14a0165
SHA1

79f2490dd858807ecf00749bc8341c04a203370d
SHA256

594c467e38874bc9b39adfad370de12f425f17bcf8877b6175c113fa094b2ee4
SHA512

65443cfcafd2b0a799f7907ffb61c2e1d0e1fb809fd665c6c6c29186d99ce01a449f7b543efc6a9b1a533273f790e70eb2c7f19557feec404aa0df7ac316beac
SSDEEP

6144:68nunPuGRppmMxomdvtf17FLYnzOy0FHChI7YZ:68ipQM/dvtxOnCLChI

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npf.sys	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

pid	Process
2424	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
2424	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
2424	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2424-5-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2424-21-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2424-7-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2424-4-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sniffer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe"	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wpcap.dll	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4300	2424	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
2424	b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 412
  2⤵
  - Program crash
  PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2424 -ip 2424
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
98KB

MD5
b4d3cbc053e70143d350d6107b94952c

SHA1
5ebdb0ef1f00a1024637adf106d7b2a9b43bbcda

SHA256
2198fd8cd738d6281c8c1fc4845effd251b3d6b7f83b9f4f927d6430cf12537b

SHA512
539244352ffc0ca6e08bba2704abd1286873375dad28421862bd9ce7a8146d9472dc5e4ac3edb59ae741f5b178cd22f976fbba62a0bc71c09160e1c9f178e523

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
274KB

MD5
dae5f233818083af69e2e5133a50a2cb

SHA1
18a2672972a9440f51b3d416a933b20b8ae6252a

SHA256
b0ce20a14e8cef5a94e2ef057e5685eac3636c6b71166b4f99af31c3422c4121

SHA512
ca71f6b0c2c1f5c00eda9af97b4426c9ca386785c5f0d712dc971ddf0b13e1a0e7ef691932b61c5fda009df2da8422df09ffaf5061aa0b674a98dcc57caa405a

Download Submit
memory/2424-0-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2424-1-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2424-5-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2424-18-0x0000000002260000-0x0000000002279000-memory.dmp

Filesize
100KB

Download
memory/2424-21-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2424-16-0x0000000000460000-0x0000000000493000-memory.dmp

Filesize
204KB

Download
memory/2424-7-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2424-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download