63ea5b4fcc87c6d29234893be6e12da43c602392677a287c58557a41d616fafd

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe
Size

121KB
MD5

fee77fd1270769142d8f119fc3c3671b
SHA1

c3ef79b95f3657f4d8c485be669fee894c8ff256
SHA256

63ea5b4fcc87c6d29234893be6e12da43c602392677a287c58557a41d616fafd
SHA512

eacc8abb0148c6c714f8fe838d362cdd2895e79f4f3877db638c0563de134c7b9ace89651f6d28185746de7e822a8884ae77979448877156c4060dc262e7e183
SSDEEP

3072:PT48CaFR2kMYPodQMZDN5whtdxA6QQSiTHRt:PT4HaFRRnrM3gTxvlnHRt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1136	tmp.tmp.tmp1
1404	tmp.tmp.tmp1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 1404	1136	tmp.tmp.tmp1	83

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tmp.tmp.tmp1	fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4236	3552	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp.tmp.tmp1
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 1136	3552	fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe	82
PID 3552 wrote to memory of 1136	3552	fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe	82
PID 3552 wrote to memory of 1136	3552	fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe	82
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83
PID 1136 wrote to memory of 1404	1136	tmp.tmp.tmp1	83

C:\Users\Admin\AppData\Local\Temp\fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fee77fd1270769142d8f119fc3c3671b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\tmp.tmp.tmp1
  C:\Windows\tmp.tmp.tmp1
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\tmp.tmp.tmp1
    C:\Windows\tmp.tmp.tmp1
    3⤵
    - Executes dropped EXE
    PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 488
  2⤵
  - Program crash
  PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3552 -ip 3552
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tmp.tmp.tmp1

Filesize
93KB

MD5
3bb2a1b632cec36b08c0efb285530006

SHA1
38b51e10dc6d79b05241f4388dac37315f62eec7

SHA256
14dc1524a7e90ff4d3fe5760690fd1c9fc8cbef948c45cfa8b5be1dd819a3110

SHA512
6b1ed456ea158ab19b70ff171cca696a7dce7f9f7928a669469254c1d1fd2676c88580c42f7d0352c718cedcc8624f588a72ca656cf90d7756f825b0bd122660

Download Submit
memory/1136-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1404-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1404-15-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1404-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download