da2ba3a6cd9a50e7461aa622fb92d0a5623e6d1a8be3e5d16aed1eabcb3e3d24

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe
Size

1.8MB
MD5

0a81bbc1b83330d03d760374094a599e
SHA1

47747c41fee807b80a437166cf9323c517d0cafd
SHA256

da2ba3a6cd9a50e7461aa622fb92d0a5623e6d1a8be3e5d16aed1eabcb3e3d24
SHA512

d2cfcc57e18936a0ee95dd68bd64b97621c49d6a46507ab77a4eff387b8dffb0b8acacd8754fbcbb486e20fbe09265ba7776b920c755fb47df464213e0702bdc
SSDEEP

49152:sY4p8Pt10/v65JrFXFarp9M0EnUH0/PdyGy8kRALLcduYZ:sY4p8FaH65Jf4aUU/PHy8kRiAdT

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5088	MAYSEX~1.EXE

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	MAYSEX~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5112	5088	WerFault.exe	84
716	5088	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAYSEX~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 5088	1828	JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe	84
PID 1828 wrote to memory of 5088	1828	JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe	84
PID 1828 wrote to memory of 5088	1828	JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a81bbc1b83330d03d760374094a599e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MAYSEX~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MAYSEX~1.EXE
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 564
    3⤵
    - Program crash
    PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 568
    3⤵
    - Program crash
    PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MAYSEX~1.EXE

Filesize
2.0MB

MD5
5d11d735caa85b42fa2da1b025895116

SHA1
997277fb62d4cf2474db0dd8628c252f362ab39b

SHA256
78559dd5bde582dd2c50bb53edcd39c277c0369148664bb55d8061defa4e53a8

SHA512
901db32c83f00f2cc221670b928b48a47eef23347489fb9113108da986d47a0050edea15e8db8f76f07343e983da1139b63754dcaa805cf59a45612eb33ad13d

Download Submit
memory/5088-5-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/5088-6-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads