Overview

overview

7

Static

static

3

4537718c32...18.exe

windows7-x64

7

4537718c32...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4537718c32721317aa592754fc93460c_JaffaCakes118.exe

  • Size

    636KB

  • MD5

    4537718c32721317aa592754fc93460c

  • SHA1

    7923a20c0699cb354289558e5b37a36f8c105ef8

  • SHA256

    ea2c0438bc6d8609438e978fe6cab70c63abb7c4411d96bc71bc2b2ef2fe14a7

  • SHA512

    61d0fa19514294fa2ad0a5eb3644b83da942f6cee9de2a905813e77c9f6186b5688ca2e6c27542697dcc021f9e4b9be85b23a3b19e56900891531634dfce6072

  • SSDEEP

    6144:k4jl/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozA:kqlonxOp8FySpE5z

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4537718c32721317aa592754fc93460c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4537718c32721317aa592754fc93460c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\ihuownxrsre.exe
      "C:\Users\Admin\AppData\Local\Temp\ihuownxrsre.exe" "c:\users\admin\appdata\local\temp\4537718c32721317aa592754fc93460c_jaffacakes118.exe*"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 344
        3⤵
        • Program crash
        PID:3952
    • C:\Users\Admin\AppData\Local\Temp\ihuownxrsre.exe
      "C:\Users\Admin\AppData\Local\Temp\ihuownxrsre.exe" "c:\users\admin\appdata\local\temp\4537718c32721317aa592754fc93460c_jaffacakes118.exe"
      2⤵
      • Executes dropped EXE
      PID:3908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 308
        3⤵
        • Program crash
        PID:2376
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2376 -ip 2376
    1⤵
      PID:1920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3908 -ip 3908
      1⤵
        PID:348

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ihuownxrsre.exe
        Filesize

        320KB

        MD5

        2c7bba828a6fbf7a2cada4b7c3a8801a

        SHA1

        125a12eb347189448bdf75f29ca514fd122d2979

        SHA256

        5993c79affb923f8d31bc37fcdb2b06316c016db7669cfa42be18f3851a46bf1

        SHA512

        90ee7ffff885fafc48f64c2ee264ed24efe57b448f91481efbc352c92878835798036aec68c7241c0643f5dee94a14270e5c079323abce49d6486b39523e9a1f

        Download Submit