353122ba17c187329a0c4c80a54857e79b08509f238684905f3d89d8e8eb34ff

Analysis

max time kernel
93s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
Size

791KB
MD5

d0ff4361eb3904e857b3055449de8881
SHA1

1b11337b99f3e37c59b0d9b9eeeeb83f4f4b379c
SHA256

353122ba17c187329a0c4c80a54857e79b08509f238684905f3d89d8e8eb34ff
SHA512

556a6574859adb6a99da112af04dc9b800c6e6a4b3606d046e838e7175bf2c400565197a7089b4bec736a5f981a9c373a887132fd7e33a84f78cbd5fa51e711f
SSDEEP

24576:w7SPL7ypiWeo7hwD5AwHu9EGQ4MyoPtW5I:yKybfjD9EGFM25I

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zkvvamqbxprptes.eu.url	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4300 2508 WerFault.exe d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

pid	pid_target	process	target process
4300	2508	WerFault.exe	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

pid	process
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
2508	d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0ff4361eb3904e857b3055449de8881_JaffaCakes118.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 596
2⤵
- Program crash
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2508 -ip 2508
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-0-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2508-2-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2508-3-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2508-6-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2508-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2508-4-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download