58e53c669cd0af2d5a06163cfabd192d8aed4c7fc0ff170df102faee3259d897

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31a24d7fddd45312db7b66c60f174e04_JaffaCakes118.exe
Size 846KB
Sample240510-3n1zdabc83
SHA256 58e53c669cd0af2d5a06163cfabd192d8aed4c7fc0ff170df102faee3259d897
MD5 31a24d7fddd45312db7b66c60f174e04
SHA1 aed4677a3199a4f20003fc0ade16bde6c10b37d5
SHA512 d2e341c36641a70743289208a2e15e226403ad86029836fd80464097be14fd1ac75eef28f7b78a4be0c056021048d2ae4d2bc9906d855fc0d26de8fede5fd23e
SSDEEP 24576:mlHKGv1BAhYeEDOxg9KRrEyPSocvgyB9Ai:mNKGTAh5gOUKrPevtAi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a00000002331b-19.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
4196	31a24d7fddd45312db7b66c60f174e04_JaffaCakes118.exe
4196	31a24d7fddd45312db7b66c60f174e04_JaffaCakes118.exe
4196	31a24d7fddd45312db7b66c60f174e04_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a00000002331b-19.dat	upx
behavioral2/memory/4196-22-0x0000000074C10000-0x0000000074C1A000-memory.dmp	upx
behavioral2/memory/4196-95-0x0000000074C10000-0x0000000074C1A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\31a24d7fddd45312db7b66c60f174e04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31a24d7fddd45312db7b66c60f174e04_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdvSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE669.tmp\AdvSplash.dll
Size 6KB
SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
MD5 13cc92f90a299f5b2b2f795d0d2e47dc
SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aero.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE669.tmp\Aero.dll
Size 7KB
SHA256 2c58ec428c767ce05e3b2c18ef1e1d9be0d6cd3a97c9f33c95666ea9a66caa9b
MD5 2329db4688b46b8cde1297575a8fc94c
SHA1 dcaf28dd61992df3ffc64468e1ff487193d83ad8
SHA512 1e6571c14faab22e6169c21867862bbaacd17bd0d8b589d8403150c62cf022b137428b681d5cffc51b6c772cc04d1213a142f1781dd3a38892daea93e2241994
SSDEEP 192:M6nmPtvco460e35M76v9gTnDg9ZLbG7ChBsZ:UvcoIYKnDg9xhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE669.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nssE669.tmp\ioSpecial.ini
Size 788B
SHA256 010bb9c12981f3ea130eae96093a4029f8994e707a492b5d3637264923428aa7
MD5 5df591f7e4cecea6ad012225309378e4
SHA1 8de3757a6fe0f03d138abdc9afc583eaf1051da6
SHA512 775d890f95d74afa18d1390835fc78967a9951e22c2b6cb4968176197a902bc5a2c92955833bad411d2bba6560a77bb62453e8880a8dada584dc684f6f4cf382
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nssE669.tmp\ioSpecial.ini
Size 827B
SHA256 5e177ed52f16b3151fda3007d7004e472b8132fb58696289b3a1b04924cffa55
MD5 e88a70c0adf290ca0a2c6fa7cf5263cc
SHA1 8714525c154339c8b704ed8d9bb3389bb6411dd3
SHA512 bed07998e4e502c48f03a9dc7c30f9ed98871411fa40a1a05d0f783ca018897571c49361e9796c77128d6cece2ee2926cfe9d6e5e0b9a21d2029db8b69eeed4d
MD5 SHA1 SHA512

Submit Download

memory/4196-22-0x0000000074C10000-0x0000000074C1A000-memory.dmp

Download

memory/4196-95-0x0000000074C10000-0x0000000074C1A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads