46b341a30c719f3dc836c9366fa44390d31be098eb9f66957d22826381eac4d0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe
Size

317KB
MD5

f0574b134033cfb9e11c518e5800ae73
SHA1

407addbf1879d1cddb26fabcc341fc85ab088352
SHA256

46b341a30c719f3dc836c9366fa44390d31be098eb9f66957d22826381eac4d0
SHA512

3bcca80811cf1cb78d0c78d05137b681516426f75ab737a192b548ba226440280ea271ee18a8c35c6305924b95dfbf911985ed5f88756aed8cf8acf3eba29c74
SSDEEP

6144:ZnvB8U3GLsvCjuVwg6ndXmgjGNUYYAleJGWS4blVJRsjTMEjN2ndh:ZRqsUuVYndXm6ntAezS+RsjYv

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4984	aPjPeNp17702.exe

Executes dropped EXE 1 IoCs

pid	Process
4984	aPjPeNp17702.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3840-1-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/3840-3-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/3840-5-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4984-18-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/3840-23-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4984-24-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4984-37-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/3840-44-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\aPjPeNp17702 = "C:\\ProgramData\\aPjPeNp17702\\aPjPeNp17702.exe"	aPjPeNp17702.exe

Program crash 25 IoCs

pid	pid_target	Process	procid_target
1068	3840	WerFault.exe	81
2880	3840	WerFault.exe	81
924	4984	WerFault.exe	82
2616	3840	WerFault.exe	81
2720	4984	WerFault.exe	82
4572	3840	WerFault.exe	81
1088	4984	WerFault.exe	82
4224	3840	WerFault.exe	81
4940	4984	WerFault.exe	82
4876	3840	WerFault.exe	81
2672	4984	WerFault.exe	82
3344	3840	WerFault.exe	81
2380	4984	WerFault.exe	82
4944	4984	WerFault.exe	82
2784	4984	WerFault.exe	82
2412	4984	WerFault.exe	82
1460	4984	WerFault.exe	82
2812	4984	WerFault.exe	82
3056	4984	WerFault.exe	82
5048	4984	WerFault.exe	82
5028	4984	WerFault.exe	82
4600	3840	WerFault.exe	81
4976	3840	WerFault.exe	81
4828	4984	WerFault.exe	82
3204	4984	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aPjPeNp17702.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe
Token: SeDebugPrivilege	4984	aPjPeNp17702.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4984	aPjPeNp17702.exe
4984	aPjPeNp17702.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4984	aPjPeNp17702.exe
4984	aPjPeNp17702.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4984	aPjPeNp17702.exe
4984	aPjPeNp17702.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4984	3840	f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe	82
PID 3840 wrote to memory of 4984	3840	f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe	82
PID 3840 wrote to memory of 4984	3840	f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\ProgramData\aPjPeNp17702\aPjPeNp17702.exe
  "C:\ProgramData\aPjPeNp17702\aPjPeNp17702.exe" "C:\Users\Admin\AppData\Local\Temp\f0574b134033cfb9e11c518e5800ae73_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 768
    3⤵
    - Program crash
    PID:924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 768
    3⤵
    - Program crash
    PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 820
    3⤵
    - Program crash
    PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 828
    3⤵
    - Program crash
    PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 976
    3⤵
    - Program crash
    PID:2672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1008
    3⤵
    - Program crash
    PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 968
    3⤵
    - Program crash
    PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1388
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1600
    3⤵
    - Program crash
    PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 644
    3⤵
    - Program crash
    PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1588
    3⤵
    - Program crash
    PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1676
    3⤵
    - Program crash
    PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1788
    3⤵
    - Program crash
    PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1808
    3⤵
    - Program crash
    PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1132
    3⤵
    - Program crash
    PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 772
    3⤵
    - Program crash
    PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 620
  2⤵
  - Program crash
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 792
  2⤵
  - Program crash
  PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 800
  2⤵
  - Program crash
  PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 844
  2⤵
  - Program crash
  PID:4572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 852
  2⤵
  - Program crash
  PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1000
  2⤵
  - Program crash
  PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1008
  2⤵
  - Program crash
  PID:3344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 644
  2⤵
  - Program crash
  PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 140
  2⤵
  - Program crash
  PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3840 -ip 3840
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3840 -ip 3840
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4984 -ip 4984
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3840 -ip 3840
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4984 -ip 4984
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3840 -ip 3840
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4984 -ip 4984
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3840 -ip 3840
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4984 -ip 4984
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3840 -ip 3840
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4984 -ip 4984
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3840 -ip 3840
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4984 -ip 4984
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4984 -ip 4984
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4984 -ip 4984
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4984 -ip 4984
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4984 -ip 4984
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4984 -ip 4984
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4984 -ip 4984
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4984 -ip 4984
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4984 -ip 4984
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3840 -ip 3840
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3840 -ip 3840
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4984 -ip 4984
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4984 -ip 4984
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aPjPeNp17702\aPjPeNp17702.exe

Filesize
317KB

MD5
435a6ceac6024561edb823bc2df5905a

SHA1
3b276507c03a328ccfe52e1f2b4c0f48b9ef24e9

SHA256
841e20734f9998f864f2fa548b5822778186bfbcfa25c32ba0ad140ee598b059

SHA512
303032a364f1b88648e6c87ae28de52ddae30b698a2e5fc9539f9ea64e450ccdcdde995a52dff7381cac190cb86e277e4f9692bf582d82974c6861d9376034ce

Download Submit
memory/3840-22-0x0000000000468000-0x00000000004B1000-memory.dmp

Filesize
292KB

Download
memory/3840-3-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3840-4-0x0000000000468000-0x00000000004B1000-memory.dmp

Filesize
292KB

Download
memory/3840-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3840-1-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3840-21-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3840-0-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3840-23-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3840-44-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4984-14-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4984-18-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4984-24-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4984-37-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads