a06234c37450221827204d8b3916efce812f11e112f05a2e07babf6fe92a216b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe
Size

2.3MB
MD5

12562f2b3ca4f32c0818f090a980526b
SHA1

b049270b200da05311df888eb0afb20f4b3cdfd5
SHA256

a06234c37450221827204d8b3916efce812f11e112f05a2e07babf6fe92a216b
SHA512

0c990f61bb7a06b04ec5c104d378ce0c2cf6dc6dcaaa4777d4d84a57edcc1398314b6ea5030fe11a746b97719b8cb69f473796050c3aa000e1ae2258fd5009b8
SSDEEP

49152:+AcKxBlruyJHOg4tV7eUFnpD5mQcY/3kLPlU:ppxB1nJu1VaUFpt7Jk7lU

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2368	12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winio.vxd	12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WinIo.dll	12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
660	2368	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe
2368	12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12562f2b3ca4f32c0818f090a980526b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 936
  2⤵
  - Program crash
  PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2368 -ip 2368
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinIo.dll

Filesize
36KB

MD5
b3b6289999a2762c7da8104e5f47f7ee

SHA1
ea3bb66a6de13d86bd40a3005374d4cc9bbb1520

SHA256
73663dff8f7ac6ee85f9a7eeca762b002ee615c03b110e0bb64fc69f7b462565

SHA512
364d476f71df9b881c34687482e8524a23eaa95bfee5b799c98eaf633880e92ee11a1dbdeeddc3f2e00a8b9cddcb937d3f1b126091d65c2cf4f4e87bafd0d6e5

Download Submit