016c4e9257ac9b2eccec5bb3799f951b32e4872ea16305076f4f536437cac560

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe
Size

168KB
MD5

04ad697263e26f5b18ef16534ad4a133
SHA1

702bdad078da6e1bc993864ee9757cacad70da0c
SHA256

016c4e9257ac9b2eccec5bb3799f951b32e4872ea16305076f4f536437cac560
SHA512

ac08283bf59c0fbfd1b8255653284adb47f56a3d396871b12946b1ff41195f0b0865d703377292ee882168dadfb541b881e7d98afffeab64950e641297c54096
SSDEEP

3072:k3vO/JDeG4O1RMunAXo5fdrgOleG2M7JPzLJ78bNO3VGu6uc1Se4cZ:uv+V4OfMunPvgS9nJ7YNkr2nRZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe

Loads dropped DLL 12 IoCs

pid	Process
1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe
1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe
1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe
1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe
1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	1872	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1608 wrote to memory of 1872	1608	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe	28
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29
PID 1872 wrote to memory of 2316	1872	JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_04ad697263e26f5b18ef16534ad4a133.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 252
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\JaffaCakes118_04ad697263e26f5b18ef16534ad4a133mgr.exe

Filesize
133KB

MD5
cdb08259f376e72d84caaff2246e7b8d

SHA1
c812ffaebdac00ea61901b2a3d0b40bd9495d1da

SHA256
c572bcb3d9c247d7f45fefaaa5d62463bf5ef701a13cbbfc160dc81fc0301a05

SHA512
1e693e099ce8cad51863e44e522cb9b67ec785891b36eb623048a8ab6d37619a2a599c8237c5757f85aa696335c57c54b55afd2a92189cc46378998dad8af7f7

Download Submit
memory/1608-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1608-5-0x0000000000100000-0x000000000012A000-memory.dmp

Filesize
168KB

Download
memory/1608-4-0x0000000000100000-0x000000000012A000-memory.dmp

Filesize
168KB

Download
memory/1608-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download