f5a4d0e83d20c19d0c1b3d80baed324cbc55e54a26b69bd8051763a8e69dae93

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe
Size

51KB
MD5

fef46640f973461394f424e0196d4c0a
SHA1

00fe3938cac2dcd3eb4d22a1de6ebec3d6d216cd
SHA256

f5a4d0e83d20c19d0c1b3d80baed324cbc55e54a26b69bd8051763a8e69dae93
SHA512

1592efdd1c2f0c1583882042ec2da8d39a9943b50bee5cd756097be0262692549925412bfb32b8e8dd44a2504f505a43bbf16c37cb0a4362a5f91cb1b7b4c734
SSDEEP

768:CKhuClzqXr3Yrf4FQSuLxrlMMMMMfMMMwMMMMMMMMMMYMMMMMMMMMMMM3MMMMMMl:CXTXUtSuf+1W

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1040	Rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syste9.dll	fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3344	1040	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
964	fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1040	964	fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe	82
PID 964 wrote to memory of 1040	964	fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe	82
PID 964 wrote to memory of 1040	964	fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fef46640f973461394f424e0196d4c0a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\syste9.dll Export
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 620
    3⤵
    - Program crash
    PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1040 -ip 1040
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\syste9.dll

Filesize
37KB

MD5
5241af826ca024d862a4872dbfddd994

SHA1
9a0514bd861a37972165ad7b47bf7d316d823e83

SHA256
88bf6485efd94115c1320d45b5db50d6eebfafc8517db353b526908489cfd89e

SHA512
efa7b7c1b7ffc1225bdda0af8413e31f390d8c726aae847f609d8dff15d3076efb693403ce1204effedc298ab3c79382bc99c6710dc4f35a6b4b45c73239bd91

Download Submit
memory/964-0-0x0000000000950000-0x0000000000965000-memory.dmp

Filesize
84KB

Download
memory/964-4-0x0000000000950000-0x0000000000965000-memory.dmp

Filesize
84KB

Download