70f7690063fe2e2dd09c6014ec3a0579eebdc16dd4a33bf67b1fbabda98ffbae

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b42d56e391efcf410b889fe9d5bd9bb8_JaffaCakes118.exe
Size

969KB
MD5

b42d56e391efcf410b889fe9d5bd9bb8
SHA1

69f9265f88a54169c993e0537b4c9d5b26c7507d
SHA256

70f7690063fe2e2dd09c6014ec3a0579eebdc16dd4a33bf67b1fbabda98ffbae
SHA512

20c185538924dde4b5a877df800c188bd9357526c088a10af43ef5db50d680b557c5fd24dcb2a0552ae173a9827e2f5de2d1108a06b8022e345cf214aec45646
SSDEEP

24576:aE/HutfwiR+W0Ui9TWluSupAm55ELeMAYNEt:5OtoH6iAluXpOSto

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\b42d56e391efcf410b889fe9d5bd9bb8_JaffaCakes118 = "\"C:\\Users\\Admin\\AppData\\Local\\21280.exe\" 0 43 "	b42d56e391efcf410b889fe9d5bd9bb8_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	428	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b42d56e391efcf410b889fe9d5bd9bb8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b42d56e391efcf410b889fe9d5bd9bb8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b42d56e391efcf410b889fe9d5bd9bb8_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 888
  2⤵
  - Program crash
  PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 428 -ip 428
1⤵
PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-1-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/428-2-0x0000000000400000-0x00000000008307DF-memory.dmp

Filesize
4.2MB

Download
memory/428-3-0x0000000000400000-0x00000000008307DF-memory.dmp

Filesize
4.2MB

Download
memory/428-4-0x0000000000400000-0x00000000008307DF-memory.dmp

Filesize
4.2MB

Download
memory/428-6-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/428-7-0x0000000000400000-0x00000000008307DF-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads