Resubmissions

14-09-2024 13:40

240914-qyh54awgjq 10

14-09-2024 13:34

240914-qvecqswepq 10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2024 13:40

General

  • Target

    e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118.exe

  • Size

    345KB

  • MD5

    e049bf2e95cfd9354cd04da57dc33e0d

  • SHA1

    e5b896193a4bcfd10723dd914e2f19fd693df9b3

  • SHA256

    2122beff06c9c868008da7f8d5659f4866b5696a809abf8c48b231db6e6a690f

  • SHA512

    f01d1c90cd261c21a7536cc907e9bf3d0a6e3b45f6f60cc18da9350f687116d404161c1d5ead05bcad30da8b2f0c94fc3068389db6820be16a06fbf8cad10dcd

  • SSDEEP

    6144:011QE6KflZF3TcH76K9Wwj1JJUkOOeaGO+/5cX52J2w:sFrITWwBJJfOOfGB/Q2Jr

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118.exe"
      2⤵
        PID:1892
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1060
        2⤵
        • Program crash
        PID:4544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1344 -ip 1344
      1⤵
        PID:2512

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsx8D0F.tmp\System.dll

        Filesize

        11KB

        MD5

        fccff8cb7a1067e23fd2e2b63971a8e1

        SHA1

        30e2a9e137c1223a78a0f7b0bf96a1c361976d91

        SHA256

        6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

        SHA512

        f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      • C:\Users\Admin\AppData\Local\Temp\tdh.dll

        Filesize

        20KB

        MD5

        1dafb2cf34f35d5814c11c4c7c97aad8

        SHA1

        3f49bcb442c672bda015eebc1e1e6ca8584b2c01

        SHA256

        a6ab79699435b6f5879e540cb754be7a637e7b878b3decd87a6a9445f81ae6d6

        SHA512

        c8c0b1529aae25a95b053f82724ac1b60e4a1ab3493187691aab8a46c93414379222c06de238b7f351bd062ab7aa8a03e5d5b2122a0d9b1b30712501b6780365

      • memory/1344-13-0x0000000010005000-0x0000000010007000-memory.dmp

        Filesize

        8KB