ad1bb3824ae8475e0788497e04aae91c44c8293cceb74baf3a84308e7bb19ec1

Analysis

max time kernel
91s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d78dd07179cf34583f991232d8fa2b73_JaffaCakes118.exe
Size

217KB
MD5

d78dd07179cf34583f991232d8fa2b73
SHA1

7d38f30a28bccce31d9813ddb74e8c72469ffea5
SHA256

ad1bb3824ae8475e0788497e04aae91c44c8293cceb74baf3a84308e7bb19ec1
SHA512

a610c4f12dc8fe52295a539ef9adf369b5171e00af81c9d3d14d4a512d99a825c0dce75ea9c68de3eb91daee9e155976e79d0eef85a8141e11fb57c3e7830b01
SSDEEP

3072:3FZMTfUcRGbzUCKFh0ZnyfxZY42fIPEwqa6Idn9CcbrXxuDQWVilY3QvdQCzo+p7:qf6zTyf4DiEwqabdnXrxZYqvcIO

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3600-0-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral2/memory/3600-2-0x0000000000400000-0x000000000047F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	3600	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d78dd07179cf34583f991232d8fa2b73_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d78dd07179cf34583f991232d8fa2b73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d78dd07179cf34583f991232d8fa2b73_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 448
  2⤵
  - Program crash
  PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3600 -ip 3600
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3600-1-0x0000000000720000-0x0000000000722000-memory.dmp

Filesize
8KB

Download
memory/3600-2-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download