ae2e35b8ed4885ba3547af211974a3aff2b61255f2a941b8091d73be821d09e7

Analysis

max time kernel
90s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
Size

777KB
MD5

127869faf0aeb94a4225f994811ea115
SHA1

ab19d35def1dee6019f9daadbd2a1f8f948f315f
SHA256

ae2e35b8ed4885ba3547af211974a3aff2b61255f2a941b8091d73be821d09e7
SHA512

9e775837dc03c98778d9afd4a6b7018c67a3299ff616b827134b51bdfa98766574445dc6922d5b27347298dcbe4ba1fbad7b4204617af2606c4060d2e2d47a4f
SSDEEP

12288:UCMgipoY0EYnqM/RuIWBe5P0VtniENNOlBWQ41bIF3Z4mxxpDqVTVOCfbQ:xZFFE8qM5uJZNCW1ZIQmXAVTzfbQ

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3712	3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	3712	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3712	2208	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	86
PID 2208 wrote to memory of 3712	2208	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	86
PID 2208 wrote to memory of 3712	2208	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 544
    3⤵
    - Program crash
    PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3712 -ip 3712
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe

Filesize
422KB

MD5
05c9527aa44c25f998018d049475f8bc

SHA1
ad9ee4abcebe6450d9fc31c326269d82be4a3741

SHA256
162e86440bddb2405968bb5bf11f02cee794d6819bdaefc88ea611654405d230

SHA512
0aeedf43d2b6eae37a56bdf6a8a2cf58930d87111e54d8020fe69d287b388a02bbd7a3bcba8063da0ede8ff953e087ff3e918f4257272757a353c1bd3b8ba721

Download Submit
memory/2208-0-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-1-0x000000000107B000-0x000000000107C000-memory.dmp

Filesize
4KB

Download
memory/2208-2-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-3-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-4-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-5-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-6-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-13-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-12-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2208-15-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/3712-14-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads