Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe
-
Size
416KB
-
MD5
b8a29e26ed8089f76eec384335f6498f
-
SHA1
1293e00916f2b2173d3ed983013922f87d586304
-
SHA256
8a826569f8938abb5a21da1ec37116c2f304543b9e630b7bb100514ac7e803db
-
SHA512
26f599fadd240797f695ab74facc9a4bac0cf41ab05945bd95eb0480454ea33f6ce42236cbd0d37647213ca5693d61d9de12e69ecc69a620215713e0ca8b8b6a
-
SSDEEP
6144:J6b2I7dBJY+l8EAnddMJfnDnDYiktjAg2SDj2uqLUITtjtz:J6qIprYLsr0iktjrpDSFJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2664 bCiEhHa15409.exe -
Executes dropped EXE 1 IoCs
pid Process 2664 bCiEhHa15409.exe -
resource yara_rule behavioral2/memory/3948-4-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/3948-3-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/3948-5-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/3948-6-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2664-19-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/3948-23-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2664-25-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2664-33-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/3948-44-0x0000000000400000-0x00000000004B3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bCiEhHa15409 = "C:\\ProgramData\\bCiEhHa15409\\bCiEhHa15409.exe" bCiEhHa15409.exe -
Program crash 29 IoCs
pid pid_target Process procid_target 2096 3948 WerFault.exe 83 2252 3948 WerFault.exe 83 1860 3948 WerFault.exe 83 872 2664 WerFault.exe 92 436 3948 WerFault.exe 83 3196 2664 WerFault.exe 92 1168 3948 WerFault.exe 83 1764 2664 WerFault.exe 92 1616 3948 WerFault.exe 83 4512 2664 WerFault.exe 92 3220 3948 WerFault.exe 83 3288 2664 WerFault.exe 92 2532 3948 WerFault.exe 83 3668 2664 WerFault.exe 92 3056 3948 WerFault.exe 83 1840 2664 WerFault.exe 92 2800 2664 WerFault.exe 92 3320 2664 WerFault.exe 92 212 2664 WerFault.exe 92 3188 2664 WerFault.exe 92 2148 2664 WerFault.exe 92 4564 2664 WerFault.exe 92 4828 2664 WerFault.exe 92 4832 2664 WerFault.exe 92 2724 2664 WerFault.exe 92 3320 3948 WerFault.exe 83 3980 3948 WerFault.exe 83 1516 2664 WerFault.exe 92 1968 2664 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bCiEhHa15409.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe Token: SeDebugPrivilege 2664 bCiEhHa15409.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2664 bCiEhHa15409.exe 2664 bCiEhHa15409.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3948 wrote to memory of 2664 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 92 PID 3948 wrote to memory of 2664 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 92 PID 3948 wrote to memory of 2664 3948 b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 6122⤵
- Program crash
PID:2096
-
-
C:\ProgramData\bCiEhHa15409\bCiEhHa15409.exe"C:\ProgramData\bCiEhHa15409\bCiEhHa15409.exe" "C:\Users\Admin\AppData\Local\Temp\b8a29e26ed8089f76eec384335f6498f_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 7643⤵
- Program crash
PID:872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 7683⤵
- Program crash
PID:3196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 7643⤵
- Program crash
PID:1764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 8163⤵
- Program crash
PID:4512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 8243⤵
- Program crash
PID:3288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 9803⤵
- Program crash
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 10163⤵
- Program crash
PID:1840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 11723⤵
- Program crash
PID:2800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 12203⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 14043⤵
- Program crash
PID:212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 16163⤵
- Program crash
PID:3188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 6403⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 16043⤵
- Program crash
PID:4564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 16443⤵
- Program crash
PID:4828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 18043⤵
- Program crash
PID:4832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 18123⤵
- Program crash
PID:2724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 17363⤵
- Program crash
PID:1516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 7883⤵
- Program crash
PID:1968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 6122⤵
- Program crash
PID:2252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 7962⤵
- Program crash
PID:1860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 8042⤵
- Program crash
PID:436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 8442⤵
- Program crash
PID:1168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 8522⤵
- Program crash
PID:1616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 10082⤵
- Program crash
PID:3220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 10282⤵
- Program crash
PID:2532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 11042⤵
- Program crash
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 6242⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1402⤵
- Program crash
PID:3980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3948 -ip 39481⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3948 -ip 39481⤵PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3948 -ip 39481⤵PID:932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2664 -ip 26641⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3948 -ip 39481⤵PID:5112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2664 -ip 26641⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3948 -ip 39481⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2664 -ip 26641⤵PID:1200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3948 -ip 39481⤵PID:3584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2664 -ip 26641⤵PID:4508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3948 -ip 39481⤵PID:4676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2664 -ip 26641⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3948 -ip 39481⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2664 -ip 26641⤵PID:60
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3948 -ip 39481⤵PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2664 -ip 26641⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2664 -ip 26641⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2664 -ip 26641⤵PID:1556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2664 -ip 26641⤵PID:1176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2664 -ip 26641⤵PID:2792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2664 -ip 26641⤵PID:4696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2664 -ip 26641⤵PID:744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2664 -ip 26641⤵PID:1664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2664 -ip 26641⤵PID:3700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2664 -ip 26641⤵PID:2840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3948 -ip 39481⤵PID:1556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3948 -ip 39481⤵PID:212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2664 -ip 26641⤵PID:2104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2664 -ip 26641⤵PID:4936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD513f853af40788e265356df48ec289cad
SHA1a3a4f858e53fbc892ef75b297e715d6bf0474119
SHA256891b97533e79696d38542c7031b02761b8e46e0a4238dede041b60fd57dd2497
SHA5124e7dcb1586642bb0ec4b885d6c9f90c4dfebd1d8067a1a559c58a533b85e6c964f6b66fb82c60179df30d72e1739e45b2bed0972020cb8f559be95df6897e6e8