Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2025, 22:13

General

  • Target

    JaffaCakes118_5bdf7869bb1d81847397d9b1704f911a.exe

  • Size

    155KB

  • MD5

    5bdf7869bb1d81847397d9b1704f911a

  • SHA1

    6cbbc2ff7716d4a27243448f943a4c3a49346f67

  • SHA256

    d677cf7723cc282da7987a3003ea04d369a651dc83184b9e523bf3ce9bc047cf

  • SHA512

    bf4d207c22ac8715bd46e9bedfa153d4c1ee70a32bfa386e3ce21f524063e149d49616a0617785d2b4434eded573bbc6793e541f24d7e55f810fd3841a5916b0

  • SSDEEP

    3072:mDb4oxo8S/clMGrsITQ+JSxNQheWZx64iXv1T04IcLWveQe9DZ+IRmQV/:c47mrzTQ9DQECXif1o12VDZX9

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bdf7869bb1d81847397d9b1704f911a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bdf7869bb1d81847397d9b1704f911a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bdf7869bb1d81847397d9b1704f911a.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bdf7869bb1d81847397d9b1704f911a.exe"
      2⤵
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      PID:1056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 332
        3⤵
        • Program crash
        PID:3972
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1056 -ip 1056
    1⤵
      PID:1504

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\BIb8Hd81F.txt

      Filesize

      2KB

      MD5

      7392a6f729a53254a354afd5305bcf6c

      SHA1

      38a1856419dfc4e087255a5ca4b91918bf841477

      SHA256

      d2687673a1c1cb9ca738034114684645f1d8e0c16aab5127fbb132d57e5c7e5d

      SHA512

      aa8f956fff96aa86b9b80349e45557f0ae3766b8db2ce9b7b39bd7b9c33978cf83800b9fa7c0174832a7f85b80c8ff02a501208896a75a23a69519f57ec534fe

    • memory/1056-6-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1056-8-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1056-23-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB