Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 11:17

General

  • Target

    17dc6fd51e152105d529f347fcacf21e_JaffaCakes118.exe

  • Size

    481KB

  • MD5

    17dc6fd51e152105d529f347fcacf21e

  • SHA1

    5b91d933af6a7b1a5fe0ef3ff829b1e0044b2ef8

  • SHA256

    5d7bc178cb3eafae7b2c99b2cfd2ceec87119cf2403f86af87435d4479f36724

  • SHA512

    4f35c90eddd617a328b3527b8dcecceab82621042f49fba7a2ea8d29174d80feb3f54dd2272c26fd64aeb57e0ec38bc1a7578197c0b9063a8ed133e7f6399724

  • SSDEEP

    12288:viDHKIAVjf7g8BaP7Hc55+CghrP0P//PK:qLJAVXaHP3ry/6

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17dc6fd51e152105d529f347fcacf21e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17dc6fd51e152105d529f347fcacf21e_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe
      "C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 640
      2⤵
      • Program crash
      PID:516
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1624 -ip 1624
    1⤵
      PID:3976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe

      Filesize

      481KB

      MD5

      17dc6fd51e152105d529f347fcacf21e

      SHA1

      5b91d933af6a7b1a5fe0ef3ff829b1e0044b2ef8

      SHA256

      5d7bc178cb3eafae7b2c99b2cfd2ceec87119cf2403f86af87435d4479f36724

      SHA512

      4f35c90eddd617a328b3527b8dcecceab82621042f49fba7a2ea8d29174d80feb3f54dd2272c26fd64aeb57e0ec38bc1a7578197c0b9063a8ed133e7f6399724

    • C:\Users\Admin\AppData\Local\Temp\A56FE8E8E07249AFA0AC27

      Filesize

      168B

      MD5

      6ebfc091660afd97b66751997731ab3a

      SHA1

      91f087897567562b10f38c0360bdb87838aab603

      SHA256

      6f654b418aed90ce9637f3dbe239457c62013b5250ef946b4a5112f343fb022e

      SHA512

      f2f34608a31c51684fead741c8b0924cb04c8361891808fac263708799ac8ead365a3e964690383acfcfaefa827b73d4db87ee9205cd1503bd4691b86b12209e

    • memory/1624-2-0x0000000000930000-0x0000000000980000-memory.dmp

      Filesize

      320KB

    • memory/1624-1-0x0000000000A90000-0x0000000000B90000-memory.dmp

      Filesize

      1024KB

    • memory/1624-3-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1624-10-0x0000000000400000-0x000000000092F000-memory.dmp

      Filesize

      5.2MB

    • memory/1624-11-0x0000000000930000-0x0000000000980000-memory.dmp

      Filesize

      320KB

    • memory/2348-12-0x0000000000400000-0x000000000092F000-memory.dmp

      Filesize

      5.2MB

    • memory/2348-14-0x0000000000400000-0x000000000092F000-memory.dmp

      Filesize

      5.2MB