653df605b6d7409ab26c3fce4b4dfabbaa6b1deb5a6aa18cba54b1dfe2d3f825

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe
Size

244KB
MD5

dd3aa0dfb4644938887627691c441ce4
SHA1

8a1fe36c5ab9c4892c589c6349e0890a29a29b84
SHA256

653df605b6d7409ab26c3fce4b4dfabbaa6b1deb5a6aa18cba54b1dfe2d3f825
SHA512

e4e43e2923de3c6b9020d03349bf70b626d5e719c497c72801cd09f2f4932a2c0dca4d76f7415e4e7306d5b7762373c17c9d69b50860ad1a6676055fd183b898
SSDEEP

3072:zaMSOePHDkUe0mVZLTYNAUnSptxldQIaevadbRS/LKfuEaLeYbnfLk8GuhSi:z4b5elZLFUSLsevadF+KfhzY5b

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npf.sys	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

pid	Process
2576	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe
2576	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe
2576	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2576-5-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2576-4-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2576-15-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2576-7-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sniffer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe"	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wpcap.dll	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	2576	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe
2576	dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd3aa0dfb4644938887627691c441ce4_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 316
  2⤵
  - Program crash
  PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2576 -ip 2576
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
98KB

MD5
b4d3cbc053e70143d350d6107b94952c

SHA1
5ebdb0ef1f00a1024637adf106d7b2a9b43bbcda

SHA256
2198fd8cd738d6281c8c1fc4845effd251b3d6b7f83b9f4f927d6430cf12537b

SHA512
539244352ffc0ca6e08bba2704abd1286873375dad28421862bd9ce7a8146d9472dc5e4ac3edb59ae741f5b178cd22f976fbba62a0bc71c09160e1c9f178e523

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
274KB

MD5
dae5f233818083af69e2e5133a50a2cb

SHA1
18a2672972a9440f51b3d416a933b20b8ae6252a

SHA256
b0ce20a14e8cef5a94e2ef057e5685eac3636c6b71166b4f99af31c3422c4121

SHA512
ca71f6b0c2c1f5c00eda9af97b4426c9ca386785c5f0d712dc971ddf0b13e1a0e7ef691932b61c5fda009df2da8422df09ffaf5061aa0b674a98dcc57caa405a

Download Submit
memory/2576-0-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2576-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2576-5-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2576-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2576-19-0x0000000002270000-0x0000000002289000-memory.dmp

Filesize
100KB

Download
memory/2576-15-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2576-11-0x0000000000460000-0x0000000000493000-memory.dmp

Filesize
204KB

Download
memory/2576-7-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download