14f4cc5ea5f85a752ad76eb57983d758671945300896200fa2160bd5592e26ce

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe
Size

317KB
MD5

ce82f1c4f48b4b92849b06f6353e4384
SHA1

112b0c066173030fa010c367484f7bb8a3a4ac5e
SHA256

14f4cc5ea5f85a752ad76eb57983d758671945300896200fa2160bd5592e26ce
SHA512

4948049126300ee61aec8529115bb1493d0b98c742e1a6ffe10b8a95bbf09f10ef579e76152539feba8eb7e0a97f299673fc98bc1edbcd57afde072f64f6a0ba
SSDEEP

6144:Gr2deC/4nXA13lwjbjHMGcnr6hDLCF1bzzFD5BrOSMInBOwUsD1N:GrHnX5Hrlcnr6hDLstzzYSMaBOwUsRN

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4320	jHbMgIh01822.exe

Executes dropped EXE 1 IoCs

pid	Process
4320	jHbMgIh01822.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-2-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4480-4-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4480-5-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4480-6-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4320-20-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4480-24-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4320-25-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4320-38-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4480-45-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jHbMgIh01822 = "C:\\ProgramData\\jHbMgIh01822\\jHbMgIh01822.exe"	jHbMgIh01822.exe

Program crash 26 IoCs

pid	pid_target	Process	procid_target
2016	4480	WerFault.exe	82
2044	4480	WerFault.exe	82
4452	4320	WerFault.exe	86
3980	4320	WerFault.exe	86
1668	4480	WerFault.exe	82
2980	4320	WerFault.exe	86
4396	4480	WerFault.exe	82
2264	4320	WerFault.exe	86
4852	4480	WerFault.exe	82
2172	4320	WerFault.exe	86
5004	4320	WerFault.exe	86
912	4480	WerFault.exe	82
1680	4480	WerFault.exe	82
3076	4320	WerFault.exe	86
116	4320	WerFault.exe	86
2400	4320	WerFault.exe	86
1376	4320	WerFault.exe	86
3320	4320	WerFault.exe	86
3564	4320	WerFault.exe	86
620	4320	WerFault.exe	86
2340	4320	WerFault.exe	86
1568	4320	WerFault.exe	86
3868	4480	WerFault.exe	82
4116	4480	WerFault.exe	82
1940	4320	WerFault.exe	86
2636	4320	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jHbMgIh01822.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe
Token: SeDebugPrivilege	4320	jHbMgIh01822.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4320	jHbMgIh01822.exe
4320	jHbMgIh01822.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4320	jHbMgIh01822.exe
4320	jHbMgIh01822.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4320	jHbMgIh01822.exe
4320	jHbMgIh01822.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4320	4480	ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe	86
PID 4480 wrote to memory of 4320	4480	ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe	86
PID 4480 wrote to memory of 4320	4480	ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\ProgramData\jHbMgIh01822\jHbMgIh01822.exe
  "C:\ProgramData\jHbMgIh01822\jHbMgIh01822.exe" "C:\Users\Admin\AppData\Local\Temp\ce82f1c4f48b4b92849b06f6353e4384_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 760
    3⤵
    - Program crash
    PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 768
    3⤵
    - Program crash
    PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 768
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 792
    3⤵
    - Program crash
    PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 952
    3⤵
    - Program crash
    PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 996
    3⤵
    - Program crash
    PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1172
    3⤵
    - Program crash
    PID:3076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 992
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1408
    3⤵
    - Program crash
    PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1620
    3⤵
    - Program crash
    PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 924
    3⤵
    - Program crash
    PID:3320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1612
    3⤵
    - Program crash
    PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1696
    3⤵
    - Program crash
    PID:620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1808
    3⤵
    - Program crash
    PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1816
    3⤵
    - Program crash
    PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 996
    3⤵
    - Program crash
    PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 784
    3⤵
    - Program crash
    PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 612
  2⤵
  - Program crash
  PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 784
  2⤵
  - Program crash
  PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 784
  2⤵
  - Program crash
  PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 796
  2⤵
  - Program crash
  PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 828
  2⤵
  - Program crash
  PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1004
  2⤵
  - Program crash
  PID:912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1040
  2⤵
  - Program crash
  PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 636
  2⤵
  - Program crash
  PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 140
  2⤵
  - Program crash
  PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4480 -ip 4480
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4320 -ip 4320
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4480 -ip 4480
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4320 -ip 4320
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4480 -ip 4480
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4320 -ip 4320
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4480 -ip 4480
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4320 -ip 4320
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4480 -ip 4480
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4320 -ip 4320
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4480 -ip 4480
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4320 -ip 4320
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4480 -ip 4480
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4320 -ip 4320
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4320 -ip 4320
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4320 -ip 4320
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4320 -ip 4320
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4320 -ip 4320
1⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4320 -ip 4320
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4320 -ip 4320
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4320 -ip 4320
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4320 -ip 4320
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4480 -ip 4480
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4480 -ip 4480
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4320 -ip 4320
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4320 -ip 4320
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jHbMgIh01822\jHbMgIh01822.exe

Filesize
317KB

MD5
b9041c502d8431b13cfc1e9c4dcd1229

SHA1
6d5cc0bdfbefa1b5590db82cead6677786e80040

SHA256
7686e41a5fe4d2e4df8768f914ff56416655c5cab7109bbff9075241bab220a7

SHA512
7a4fdde966febd6691b8969a33778d29c52cf017bc7883eb5df799791d7223fb3ecbdf534fca2f21b9ebac43283c807626d2c4c03fa77a2bd9c5324a82d6f31e

Download Submit
memory/4320-20-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4320-15-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4320-38-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4320-25-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4320-19-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-6-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-1-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-2-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-0-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/4480-23-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/4480-24-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-4-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4480-45-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads