ed9a1ccabdfd4b700434a8c18f8684298602d1f47bd95835c783d993582fa9a4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe
Size

769KB
MD5

d04b0f46099868449ca4ff43697b5fa0
SHA1

d946168be53596d48c4197e52caad8dd35e05a9d
SHA256

ed9a1ccabdfd4b700434a8c18f8684298602d1f47bd95835c783d993582fa9a4
SHA512

cd620ae1c119bedb03c924265e9eaaf0695785f4b02cb9d576ea658dc435d5d100d0dcee205020a22b1c43f19085a9bc59e8fa3fcb3899914f4a0f74edcf2b22
SSDEEP

12288:yhzfDw84KLytkiFU41T8+Pw2Fw/vRwZNdB1I1sLfdDqF3Z4mxx746iYsJkczL4oU:MLkQE81KZNdB1I1oFWQmXvVubzL4o8p

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
744	SERVER~3.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	744	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVER~3.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 744	4920	d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe	83
PID 4920 wrote to memory of 744	4920	d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe	83
PID 4920 wrote to memory of 744	4920	d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d04b0f46099868449ca4ff43697b5fa0_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~3.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~3.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 264
    3⤵
    - Program crash
    PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 744 -ip 744
1⤵
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~3.EXE

Filesize
402KB

MD5
1a682e05bf328282d7a192240934b0fd

SHA1
62e88916b4006f65bd8f84442c6a2c971f3b9ff9

SHA256
9d60b2a4e16cfb45214fb5cf68d909f9bc8409386f1a7c7f4922a72789a405e8

SHA512
6017bf1d0bd5c63fba1426ba817a8b40733a8586d1346febff65b748c7321a5f1dca07c4e0a052f0ffa21b0255a9d23a18d506cd7b321af85fa340bb470b8f21

Download Submit
memory/744-16-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4920-8-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-4-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-3-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-9-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-0-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-7-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-2-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-15-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-6-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-5-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download
memory/4920-1-0x0000000001078000-0x0000000001079000-memory.dmp

Filesize
4KB

Download
memory/4920-18-0x0000000001000000-0x00000000010D1000-memory.dmp

Filesize
836KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads