be1d7f941d693b38a6a05599fd78f49cc9cbd83963bc51ad50e5f2e3c1ab18b2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b71274733b8257b62d9848955836352_JaffaCakes118.exe
Size

25KB
MD5

2b71274733b8257b62d9848955836352
SHA1

795aa731ee073d2ef56a806dc9a75c8fabbffc4a
SHA256

be1d7f941d693b38a6a05599fd78f49cc9cbd83963bc51ad50e5f2e3c1ab18b2
SHA512

8039ec001cf788fee00029ffb0aaa9a05498a17e05bfc452aa44e98352782d0aa9da4a88304d48bdb85d1eed13712496b21ae1c4112d87cca9c6e55b945ba129
SSDEEP

384:Ww4ExxlmrsnNZWfD8Ld0hvZ/qDHzHxKsYZSdy7WvVisfXXRx3d6sCtdUb:Wy3l8aUQHzHxKsty7iis/h1d6r

Score

5^/10

discovery upx

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\icf.exe	2b71274733b8257b62d9848955836352_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	2b71274733b8257b62d9848955836352_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icf.exe	2b71274733b8257b62d9848955836352_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 1308	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	85

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1812-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1308-2-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1812-6-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1308-8-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1308-7-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1308-11-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3504	1308	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b71274733b8257b62d9848955836352_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1308	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	85
PID 1812 wrote to memory of 1308	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	85
PID 1812 wrote to memory of 1308	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	85
PID 1812 wrote to memory of 1308	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	85
PID 1812 wrote to memory of 4932	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	86
PID 1812 wrote to memory of 4932	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	86
PID 1812 wrote to memory of 4932	1812	2b71274733b8257b62d9848955836352_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\2b71274733b8257b62d9848955836352_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b71274733b8257b62d9848955836352_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 352
    3⤵
    - Program crash
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\4915203.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1308 -ip 1308
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4915203.bat

Filesize
263B

MD5
a4099eec77f87b89eaae7583c1408f44

SHA1
ca42aaa12b05227e5a787d68a86c0495703eaf79

SHA256
dbbb4992e9f21bc8b3f2f7eca987b560b3d5ddb51c0c6423f341372aab17af62

SHA512
df80392d983cf198d7aae7cd6ad95d899de914f56a379cc25aa40aa6883d1069ad8bc8ed04d97c66ef47634034fc90f80b0e1912c0216548c3304a38de2452af

Download Submit
memory/1308-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1308-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1308-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1308-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1812-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1812-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download