aacd42d73c5491c40e1e6e550e21afa364d7bf30a08c61c24b89708ae0adea80

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe
Size

59KB
MD5

d0382ce6a7ffbf40da3b589db1de5fe7
SHA1

f867e2b0be55934a67106e38f7d6fa912d9d1ecb
SHA256

aacd42d73c5491c40e1e6e550e21afa364d7bf30a08c61c24b89708ae0adea80
SHA512

671b6bffea8b922eb917288ecd7641943ef008a88967bf1d1dafa7079f207b60416c2990c4df4ddd01953607d981eb3308cc232c54b50bc6049e3aafc8b73b61
SSDEEP

768:/fmoAx8ixcjYtXPhfGmS9tEXb4xGIcqUVsaG3Plo038ea7eHKuuRcAV4ceLALB:mmdmOhtU8SqIG/qY8tVRv4ALB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4312	d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.005920c.001	d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\.qcixwp.dll	d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4960	4312	WerFault.exe	84
1684	4312	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0382ce6a7ffbf40da3b589db1de5fe7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 492
  2⤵
  - Program crash
  PID:4960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 516
  2⤵
  - Program crash
  PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4312 -ip 4312
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4312 -ip 4312
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\.qcixwp.dll

Filesize
104KB

MD5
362e6a2af3d0678fbf8517b1175e5e16

SHA1
bacb7e24040edf4699b1f09d18354eb8110c945e

SHA256
47837460cae846a40166cca8ef71506633bb6b74ee24aaa2c9952f58daf7cc3c

SHA512
bf93fe7261cac4eb746fba185df9dd5ef0cbd380a2d05a4e8d2a43ce4f9aa8a99e94a2c6cedd1e4496e4bcf769a9701623a00b2e70397edb0eb77343dba255b9

Download Submit
memory/4312-3-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download