Overview

overview

7

Static

static

3

eab8790835...18.exe

windows7-x64

7

eab8790835...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 06:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eab8790835f9c7bd6c5091aeabfa8206_JaffaCakes118.exe

  • Size

    492KB

  • MD5

    eab8790835f9c7bd6c5091aeabfa8206

  • SHA1

    375f783b509a9f0dab6aa478937a88f01e1991c4

  • SHA256

    35c1ebb608f0149a2ffeb672bdb1105b3768bd91fa61d8935bf19899c075f0c8

  • SHA512

    d85784bf3a0d8cac8f957f203a3038e0196cffb0a4e4cce9426c07974becee58cce22efe0273f0718495058e5647f4b6c8091babec19b633ccf6f064c694ea9e

  • SSDEEP

    3072:/kuAXH//0ljm5m5Yk09Mp8cn5+wLUpZA:/8XXRUw9Oz5+iU

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eab8790835f9c7bd6c5091aeabfa8206_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eab8790835f9c7bd6c5091aeabfa8206_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Users\Admin\AppData\Local\Temp\njpwspnnxtz.exe
      "C:\Users\Admin\AppData\Local\Temp\njpwspnnxtz.exe" "c:\users\admin\appdata\local\temp\eab8790835f9c7bd6c5091aeabfa8206_jaffacakes118.exe*"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 216
        3⤵
        • Program crash
        PID:4344
    • C:\Users\Admin\AppData\Local\Temp\njpwspnnxtz.exe
      "C:\Users\Admin\AppData\Local\Temp\njpwspnnxtz.exe" "c:\users\admin\appdata\local\temp\eab8790835f9c7bd6c5091aeabfa8206_jaffacakes118.exe"
      2⤵
      • Executes dropped EXE
      PID:4860
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 180
        3⤵
        • Program crash
        PID:4640
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3932 -ip 3932
    1⤵
      PID:4140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4860 -ip 4860
      1⤵
        PID:3660

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\njpwspnnxtz.exe
        Filesize

        308KB

        MD5

        355ad578c977d582cd461e1ad965e476

        SHA1

        59d1280b50b6b8b9d9b4101946810f765bb8e66a

        SHA256

        f6fae07887bb640c82a9e50bf4e897c40c9260122c1a94e3a2e809aef9afa7b6

        SHA512

        b47b8e60b6e1011e1e6a9926b086bcdf7c9a1ed9e9132b2e07c381c5fbe9d4fc52c4db4eb02c9fa2204c068ab46a349e744aae13436f115c2e8400ab607d0734

        Download Submit