a50191a2537cf898e66952dff4ed64e40fc7e6a461ae602a94b0b91762ae58aa

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Size

4.6MB
MD5

7995a05fe95df572420c0dbdf1e03c98
SHA1

afb7acacc6a3b2a254bba7e4e5e7530e73dbc7fb
SHA256

a50191a2537cf898e66952dff4ed64e40fc7e6a461ae602a94b0b91762ae58aa
SHA512

5f9ecb2588343648af2eab61e6bc83d75a17ea524da8cf45eed49793023fa2fb3c58c906465f520c42374029f88cd4348b6e527e8f30bf63d80da00b055b0952
SSDEEP

98304:B0sGbip3QG9Lvx27sp+BSNnUYueile4vU:rBnAM

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98mgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b29-3.dat	upx
behavioral2/memory/1480-5-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	1480	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98mgr.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\Browse with XnView\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe,0"	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\Browse with XnView\command	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe\" \"%1\""	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Browse with XnView\DefaultIcon	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\shell	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\xnview.exe\shell	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\xnview.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe\" \"%1\""	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\DefaultIcon	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Browse with XnView\command	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\Browse with XnView\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe\" \"%1\""	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\ = "XnView Image"	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\xnview.exe\shell\open	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe,0"	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\Browse with XnView	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\xnview.exe	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Browse with XnView	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Browse with XnView\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe\" \"%1\""	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\shell\open	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\Browse with XnView\DefaultIcon	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\xnview.exe\shell\open\command	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\Browse with XnView\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe,0"	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XnView.Image\shell\open\command	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1480	3488	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe	83
PID 3488 wrote to memory of 1480	3488	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe	83
PID 3488 wrote to memory of 1480	3488	JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98mgr.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98mgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 264
    3⤵
    - Program crash
    PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 1480
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7995a05fe95df572420c0dbdf1e03c98mgr.exe

Filesize
104KB

MD5
84b7783804fa7506672a409e9899c6be

SHA1
2da8a6e9c04662564e18cdf98f73e224a5662533

SHA256
b26a93c17ac6a412c6c191aa6a1543537f3185fe813c24153c6dec736fbad4ef

SHA512
8a867296b05f45dd79ab64b11b6cc0cc8fad835b2f5ba9b8469981cc9b3e15c91f98b688cbe7addfab7ea2bd55a1d475fc853c004afb24be1b5691f8183c897c

Download Submit
memory/1480-5-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1480-6-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/3488-0-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/3488-81-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download