3a89f7b04785dde375c621618575a3960cb47f63d5eab983a40fc1058c2c0d1b

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc591438725f7775241746448614cd5f_JaffaCakes118.exe
Size

215KB
MD5

bc591438725f7775241746448614cd5f
SHA1

be4b257da09fdc8c10987fcd8a0e29950362685c
SHA256

3a89f7b04785dde375c621618575a3960cb47f63d5eab983a40fc1058c2c0d1b
SHA512

87be00e52d89a32a15fd8dc2d6fce587314abefc90f6c5624a99f82620841610418a81abb8605faf3c3c0444ff46039290ce4ae72c33a7a5996f40285d32cf4f
SSDEEP

3072:4gaxabV06zyqbV9JAClCODs1NGvgVx9x4x+c4S49LpwRNg5:MWblS1NGvOyTN49LpwR

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral2/memory/3152-3-0x0000000000400000-0x0000000000437000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3352	3152	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc591438725f7775241746448614cd5f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bc591438725f7775241746448614cd5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc591438725f7775241746448614cd5f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 872
  2⤵
  - Program crash
  PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3152 -ip 3152
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3152-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3152-2-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/3152-3-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3152-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3152-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download