f6973271ac1f735395315fb47870eec7b7a2a9718e014376d4650b2e2a95ecaf

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe
Size

69KB
MD5

dcd21d3523bcd683f8a2929f33344978
SHA1

d97bfb456b981f699789f6b699befd4774b43584
SHA256

f6973271ac1f735395315fb47870eec7b7a2a9718e014376d4650b2e2a95ecaf
SHA512

7a86d4fe3faa204e8e2cebbff27cc6241462c4be35e291982d00d969c2cbf6d619b52eb6d7ff323d1dc8b07d14a411f9ec03ac12ee0cece42a94177129426964
SSDEEP

1536:iYfWamqp9NvihgqlsblcINUkxoNuudXpiHTjl5:i7e9NvQVlsb9UkeNuDzjn

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3664	dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0004edf5.001	dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\robtoq.dll	dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3256	3664	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcd21d3523bcd683f8a2929f33344978_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 484
  2⤵
  - Program crash
  PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3664 -ip 3664
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\robtoq.dll

Filesize
94KB

MD5
cf7722e07bf28bdf2c05dcc3da33f956

SHA1
312b6a65ac6497ebab79681fd67b52d901499af4

SHA256
dcec1eb9e3e65f7eefc5b3368c6c68847c0ad3fc87f9e6cc1a4d6f88e39f572a

SHA512
d7e3e7d8d3f5df3a01fba33b462a31aeaa184d79a95df290da86e93670fde9ecbd9e30f37448fddef764e4277f4d9b5861b71338fc41d26a9525f720dda749fb

Download Submit
memory/3664-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3664-4-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/3664-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download