ed1dfbe3a29b9cf09845df11625fb386c5955b9f3e181b8be0c72a49393e6026

Analysis

max time kernel
96s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30af49af84f55a8002268fd0afeed4e2_JaffaCakes118.exe
Size

12KB
MD5

30af49af84f55a8002268fd0afeed4e2
SHA1

8656129d906615286a2b89ec0d376ada6e121db5
SHA256

ed1dfbe3a29b9cf09845df11625fb386c5955b9f3e181b8be0c72a49393e6026
SHA512

180c7fe718a828786fcdfcb5c4d2ca8061d04112ad68a673bdaae353a4f8fdb3fef6105ea128efdb1a3cc26d831a3a57e8e3676e446a1d7b73add7cff588da68
SSDEEP

192:XGM9yxORhD1Z2jj5Pr9jZvRg8eZticEnSmEyncjWOL2edSgR+zj:XB9yxChD1Z2jtPr9jVm8eZtcn1n8j2

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
732	3776	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30af49af84f55a8002268fd0afeed4e2_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main	30af49af84f55a8002268fd0afeed4e2_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.master69.biz?1215"	30af49af84f55a8002268fd0afeed4e2_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

C:\Users\Admin\AppData\Local\Temp\30af49af84f55a8002268fd0afeed4e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30af49af84f55a8002268fd0afeed4e2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 916
  2⤵
  - Program crash
  PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3776 -ip 3776
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\exsplorer.lnk

Filesize
196B

MD5
4633633e1edefc103a561eda21648d9b

SHA1
92843fadf0f33e8989425b3f9b7b98890cfe65f7

SHA256
c7b28796da028eb9e1885ff7888fd0c4a738dca62cef592d4f535da23e1a34c9

SHA512
5afdc13db4200e3a45810efc4a4f43a7dcfff7e3b3e483ddc26d5f490389e1ea30495021eb3132390e73d72c1eacacbe9601255defc0c57c226e62e292ffc552

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads