e328c256a58b936a521288dc965fe7534fc719b5343a89135dc65bcf1da51e47

Analysis

max time kernel
95s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da884620bf5c29824d5e9e6c76b3ffe0_JaffaCakes118.exe
Size

198KB
MD5

da884620bf5c29824d5e9e6c76b3ffe0
SHA1

2f933e09e6b31adb596d5edadc04fed6b3c5f2e6
SHA256

e328c256a58b936a521288dc965fe7534fc719b5343a89135dc65bcf1da51e47
SHA512

eebb16282b24ddba523c8be8b1d13b00106b563d01a8e6fe10562189b534ad3fc597156c82027cd4b21c7be4e51cfaf1b7d95251febd6dfaf58b901361cd4f84
SSDEEP

3072:8a5IHwrHptvrOhCiIC8rtLLo1D0rGIZCgzlAORRs85MmCaMwuT3gX7Zbxs3K3:8avHptIEnoV0aCCgz+ORRZ5MAp9dbIK

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1424-0-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/memory/1424-3-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	1424	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da884620bf5c29824d5e9e6c76b3ffe0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\da884620bf5c29824d5e9e6c76b3ffe0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da884620bf5c29824d5e9e6c76b3ffe0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 420
  2⤵
  - Program crash
  PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1424 -ip 1424
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1424-1-0x00000000021E0000-0x00000000021E2000-memory.dmp

Filesize
8KB

Download
memory/1424-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download