Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 17:51

General

  • Target

    b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe

  • Size

    216KB

  • MD5

    b47005de33ed2b076fd32bd2adc39d83

  • SHA1

    ffb0b4450341e2c04d39cb3845e879af2c5961bf

  • SHA256

    509acabc2196bd8e98d6480d46f9358f199e55740579145b8a4a6ca8e90d76f0

  • SHA512

    01bedf9a27e1c777170cd950826a5f4c6b126904bb4f7fac42380d2c823154d4d69bf4472ceb621947601cc5f5fb514307d0f768427fb17783928b035ec8b442

  • SSDEEP

    6144:Q6WEDffYdnsWF3HGtuvNhUmtPxNp7wWer7Wq6yvDE:Q9E7fYdnNXGtAzsWm6yg

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ndcyox.dll,Install
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1160
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 568
        3⤵
        • Program crash
        PID:4688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 532
      2⤵
      • Program crash
      PID:3936
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1160 -ip 1160
    1⤵
      PID:2236
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1156 -ip 1156
      1⤵
        PID:4760

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ndcyox.dll

        Filesize

        56KB

        MD5

        3038c779df2ad97b71102a689cd866cf

        SHA1

        e56d6e0c0545f2c6d9187ce06c0c3fe17aa51db0

        SHA256

        bd0e43ed3cd340145b55fc1685c66a644426127041b1dad97a563b31e8733f09

        SHA512

        1a80f5276593541a94842d627a4f11b4bfa768ce0e00c15176d8de2e975a4084ee9fc78eb272aebf3a60cf2419d76814a0b408b631099a284cb86a82a28bc5f2

      • memory/1156-0-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/1156-1-0x000000000042B000-0x0000000000433000-memory.dmp

        Filesize

        32KB

      • memory/1156-2-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/1156-3-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/1156-8-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/1160-7-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB