d7ae3eac95d50bffe3877f35cf05adbe3a1924f9d7b876061c436777712ff898

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe
Size

1.6MB
MD5

438160fcce7b3d3e6eb5bb8d88e18eda
SHA1

79a2fa3e45c8457338498ed4a1c2ca6d4b9927b5
SHA256

d7ae3eac95d50bffe3877f35cf05adbe3a1924f9d7b876061c436777712ff898
SHA512

147404c430cb6d44f20dea0159157bb156c1811e3e49d5cb9085a37cdcb420fe72a6cb8296910d48687da32f6ecb83e4315a4ce9d08e064912e0683a285182d8
SSDEEP

12288:jNIfj7DDDLdddddpDYhdefOV53PLtGH3MMZ938MM95zoKBX:jEzOe2V5jEXMMgMM95zfX

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5080	Winkjwj.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Winkjwj.exe	438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Winkjwj.exe	438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3452-4-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral2/memory/3452-5-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral2/memory/3452-7-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral2/memory/3452-6-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral2/memory/3452-3-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral2/memory/3452-21-0x0000000000400000-0x0000000000499000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	5080	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3452	438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\438160fcce7b3d3e6eb5bb8d88e18eda_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\SysWOW64\Winkjwj.exe
C:\Windows\SysWOW64\Winkjwj.exe
1⤵
- Executes dropped EXE
PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 216
  2⤵
  - Program crash
  PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 5080
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Winkjwj.exe

Filesize
81KB

MD5
a1a28f6e8014cd51b0121caeb04f2e14

SHA1
815740fecd3004d67ec05a1c421b48890ee7aa11

SHA256
b6c879e17c2d22ef502d1b30b6773078e96b967bcec34532e04a2865ceeb9172

SHA512
6a400ae5a12ed64b7b9a8c0d8a3dfac1f5b07a01df8c4e5ffe6753c5b19e6f8df905e1e7a9936020f83758fc2739ea2be8a5754e7258147c322f8b9bbfa7f4d6

Download Submit
memory/3452-0-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3452-4-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3452-5-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3452-7-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3452-6-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3452-3-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3452-21-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/5080-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download