2feeb5c0a971816e59f3f7d75cdc24312afdc53191cb5010b74a62486a6c40d5

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
Size

8.8MB
MD5

305a525f7fb9544a656295509c29c90b
SHA1

201649b0bd9c8e34bcd3585d42de9661f94248af
SHA256

2feeb5c0a971816e59f3f7d75cdc24312afdc53191cb5010b74a62486a6c40d5
SHA512

332aee0479125b9be5345912fc593cdf06eb46e74d5245a31703505167f17a4eabbd87b9aea9647e73839a7badf7a3bc9c09dc792c6d803b379b7be02a2ae07d
SSDEEP

98304:Dcm9ik5yhLMj/EtLK3BDhtvS0Hpe4zbpaAKQkroGIC:lwK+MxBnvjeApaAvkt3

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\desktop.ini	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\desktop.ini	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\en.ttt	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\uk.txt	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\oledbvbs.inc	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\sqloledb.rll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\msxactps.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\hwritash.dat	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sv.txt	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\desktop.ini	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	1008	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\305a525f7fb9544a656295509c29c90b_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 512
  2⤵
  - Program crash
  PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1008 -ip 1008
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
10.5MB

MD5
ae21d6c044090d9849695994b7710a8e

SHA1
fbbf40f7964d345eed537e8b28d96247a624ce83

SHA256
3c2c0f34c359305e6585ea02a035a1d66108f5ea8d8b9443944b9a5ea226ef6a

SHA512
92f7910e24c91aba4eaa4603597ea1e727c3999bed476212e287190ac618f3841f525c0172224ade7ea3df26d2dd77d8982c085e901c3c2ad1959bd0838b8039

Download Submit
C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
memory/1008-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1008-1778-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download