51d2ac756267aef5a117156e75380547ab05f72a9a11e355004bca39227b6a4d

Analysis

max time kernel
135s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c07ba0aa3de0ff3a6332ac7bae7ed5b6_JaffaCakes118.exe
Size

366KB
MD5

c07ba0aa3de0ff3a6332ac7bae7ed5b6
SHA1

2316ef810ef365192d02fcfd13bda29658d1f016
SHA256

51d2ac756267aef5a117156e75380547ab05f72a9a11e355004bca39227b6a4d
SHA512

f9ddb57e8d5dbda5f88d5e196c2ae78d6634317efc2fb254ab3f7cfbeda216add461311644475ec526a567aada60ccdee4b5eec2632dcaca7d84276ecfc1ee8c
SSDEEP

6144:yALIgSp5jZ28ZrjAfYblYdxwl1uuFW0yAZa+3+AVOEMyK:hsgQ5T3AfCkAZTMyK

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/444-0-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	444	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c07ba0aa3de0ff3a6332ac7bae7ed5b6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c07ba0aa3de0ff3a6332ac7bae7ed5b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c07ba0aa3de0ff3a6332ac7bae7ed5b6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 224
  2⤵
  - Program crash
  PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 444 -ip 444
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download