4de35ea5d1f54708e27e4806246a6c9d9b2217cfef24c7b2321a8f6026c5d98c

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_371c76d36256463a54d34e12d6741720.exe
Size

251KB
MD5

371c76d36256463a54d34e12d6741720
SHA1

41843093a5b3a7f5712abd30937004b203851252
SHA256

4de35ea5d1f54708e27e4806246a6c9d9b2217cfef24c7b2321a8f6026c5d98c
SHA512

f2e87fb4628a8b413ced0d92bcedafc4667e8655ac2c13fa15b7f806ddd19daec919003da80f4157f83e5a24b24a4ccac98c2dfd351227b6a549443c8e7c5759
SSDEEP

6144:wBlL/cR8tpViH8hHseEJ1eG6/211J5nQEnURg0HZoAA:CeRSpNhH1EGZc5tURggZoAA

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1964	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	1964	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2768	1964	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	82
PID 1964 wrote to memory of 2768	1964	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	82
PID 1964 wrote to memory of 2768	1964	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 988
  2⤵
  - Program crash
  PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1964 -ip 1964
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsaB93F.tmp\ztqv.dll

Filesize
32KB

MD5
97d84d39bb68b5a29e976b40d7d0a00c

SHA1
cf4c09487fffb9ace9ab6b82f33da0d5a851ef1c

SHA256
5b29c5ee49d9cdde15d88a9e4f8f6b4bba9e2dc4ec65c02d734726fe0f2952c8

SHA512
aab5b8831538f96c00e77f16349065bfaa93e7b25206a6d5fe0871f518f38ae31437f2f9f93f36f488e1869eaf97dd4697a282d726ce9a292cf4276242733546

Download Submit
memory/1964-7-0x0000000010008000-0x000000001000A000-memory.dmp

Filesize
8KB

Download