c86d19c684d18252121cfd5d36c87d8dc364fdcc0a6c9d8f7f5af7ff6b6461a1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
Size

248KB
MD5

45ca8fc5a1b61044eabebd8acd4b0b78
SHA1

29bec22e63b92b761c08b995ccc3245fff185938
SHA256

c86d19c684d18252121cfd5d36c87d8dc364fdcc0a6c9d8f7f5af7ff6b6461a1
SHA512

2d437dff4c1b01428e9f551163936fa031123b24de92b7be8fa43645ef8bb9fa3c46bf6687e7db11d62dde46cba45e3c99c32eeb451754b5ec2c9266c923f71c
SSDEEP

768:jZKM11gG4ChfiPO0rfz0shcUypMC5/VKhZyg3iepFV222qSFs/IqY2sO2S9:gMDgG4ChfiPOefgsOUqQwg

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System applets = "C:\\Windows\\System\\applets.exe"	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Syssrc32 = "C:\\Windows\\Syssrc32.exe"	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fndfst32 = "C:\\Windows\\System\\fndfst32.exe"	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer Shell = "C:\\Windows\\System\\Explorer.exe"	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\Sysexp32.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\System\Sysexp32.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File opened for modification	C:\Windows\Help\intret.cnt	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File opened for modification	C:\Windows\System\mplayerw.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File opened for modification	C:\Windows\System\applets.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\System\fndfst32.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File opened for modification	C:\Windows\System\Explorer.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\Help\intret.cnt	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\System\applets.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\Syssrc32.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File opened for modification	C:\Windows\System\fndfst32.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\System\Explorer.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File created	C:\Windows\System\mplayerw.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
File opened for modification	C:\Windows\Syssrc32.exe	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4784	2364	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\Explore = "%SystemRoot%\\SysWow64\\NOTEPAD.EXE %1"	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\System\\Sysexp32.exe %1"	45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45ca8fc5a1b61044eabebd8acd4b0b78_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 332
  2⤵
  - Program crash
  PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2364 -ip 2364
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Sysexp32.exe

Filesize
260KB

MD5
54b1762cccd95266f9dbab7b50812339

SHA1
0eaabd7435c3935bcd2a1bca7dd85e541109f6b0

SHA256
984ed58d6f0b59f505f19544ffc60bad40b1d38b731d4dd9a85fb559853f2740

SHA512
039e59c3c2fe2215b6ddea82540cd21bff03f8c05ac2917c9e21237d7a8f3a7197ddb3ade79549dd2b7b5a247dee692d4a232e1f08a8196d32a687de681db45a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads