134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
Size

2.7MB
MD5

5ffefb2fa977a638c88c558abfb85443
SHA1

3fc18cbd4c3b02b29a9de38ff7fcfd5693477b1d
SHA256

134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22
SHA512

c7cdb85e11992e89482d49ea854957101ae2d4670658ecc5ebe10a3d32cdb8a5dbf2503de26b8ad6b82881cf970f1cdfa78d521723cc0e55723c58302c6d9e28
SSDEEP

49152:QeLbg5XIK9lZxL0nw0Pelu8G5UoyMl/g3RoD8a/klTCo0:QzY0GPeoVOoyMFgyVscX

Score

8^/10

upx

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	2572	rundll32.exe
7	2572	rundll32.exe
9	2572	rundll32.exe
12	2476	rundll32.exe
15	1580	rundll32.exe
16	1580	rundll32.exe
18	1196	rundll32.exe

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000014e71-66.dat	acprotect
behavioral1/memory/2224-112-0x0000000000490000-0x000000000049A000-memory.dmp	acprotect
behavioral1/memory/2224-101-0x0000000000490000-0x000000000049A000-memory.dmp	acprotect
behavioral1/memory/2224-106-0x0000000000490000-0x000000000049A000-memory.dmp	acprotect

Loads dropped DLL 29 IoCs

pid	Process
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
1580	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000014e71-66.dat	upx
behavioral1/memory/2224-112-0x0000000000490000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2224-101-0x0000000000490000-0x000000000049A000-memory.dmp	upx
behavioral1/memory/2224-106-0x0000000000490000-0x000000000049A000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2572	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 2476	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1580	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	30
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31
PID 2224 wrote to memory of 1196	2224	5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ffefb2fa977a638c88c558abfb85443_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\InstSupp.dll",CmdProc --Level --Supp 190 --Ver 153
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\InstSupp.dll",CmdProc --Goo --Proc checkinstall --Supp 190 --Cid 61167229-73BA-E949-9FA1-19556AE7AA28
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\InstSupp.dll",CmdProc --Check --Supp 190 --Uid 75AA728CC5F54F4DAC3D1806C71BD588 --Ver 153
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Maps connected drives based on registry
  PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\InstSupp.dll",CmdProc --Res "C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\nso1B50.tmp" --Ver 153 --Supp 190 --Err 5
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
4729bdc0e745b3293b606e2af8a3986f

SHA1
5c5bca22089d566d5f4e2836ea97026952ae1b1d

SHA256
ab2d2c145ab00319ef5b1c4fe09623700a26c25fa009dc18bc3cde11c5bda0ec

SHA512
381e495c91ce282e54940596b53998e152e196eb257853e3c0d97a3e4a26cbf7041cfcaf179ad213d93058aeee9987292dd2302a1219b23a2190aa898910466a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
583a59708162241271abb8f05ae278a8

SHA1
9cd8666d8313a8e4e6d152dc847ff5577391d0cc

SHA256
a3b52e1b809c8b408ca1c0810a8dba0be5e21b5f43cccd08baeff9782b753562

SHA512
fc014e997d571d0763592a1c4b4ce612f01d384b4216d2a42d6aa9ad7d45b4095694640bfe24a1f28c7e322cd3c4558603015f52a5653553f7421ac523b1e179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2235db1f5c707a84e214b28a952b7ba

SHA1
2b2190b187f90904a61950980a409d5b39f73c32

SHA256
bbdb37232a8ec18b68aecd5d56155f8dd5a9c3ab05c37ee0ab4dfeae471bf9d0

SHA512
98ad7423bd0c79567e6e24279adfba923473732c538fb2113bcd930689752f5afaa60d98e39c689aeecc674da5a374c9518a3dc0c606b4206e08c966de738340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
2984d1a03f68b509d354eaa4f2908fb1

SHA1
cfe159d24f504f261317b5d1b0ad20baed9b005e

SHA256
a6c9b143c030e8e5daf9c846cf1018a011d9527e518e7e6dc21db0c3abe51648

SHA512
a93451bc4498a3d1b6e59ed981f5374f80b6294f8341d08633f7e21814ce49500f1824c8cc2c5a472bbdc261dc0ffd23361da4ac8248186ec8edd7bdc4d7f74c

Download Submit
C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\InstSupp.dll

Filesize
365KB

MD5
8f11c131cfa10a7f4df6713a600edc4e

SHA1
f778dde4e4e07c2851787aca0d9599bacc89d112

SHA256
6b983cb710acb18c3f41fb0b0593a437f824f467adbdbcaee754bb78b7a10493

SHA512
e1a1841a3f45aca5c641440ec4ccb371d3f593d6e7b31dacf0072efcdecddc845ac54344be196404e0e8bba03330e1d02b07d3a3637c3bc1e5dc30eddd72aae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\261289F1-B106-4845-8E8F-8311F8014D2D\nso1B50.tmp

Filesize
1KB

MD5
77ad85f1ab5ae283d86d4aa412af61b3

SHA1
550d2e4488583ad4ae110dcf7e892b2c921ffebf

SHA256
863fdd002a2dc2786dad5a202332bbeafd606880e63f808af7fe50e5d920190e

SHA512
2890563578b5e48b0c553bd048107e75f1ac90b37d733f4a2755d631a3fa6ee2db632b225acf20aac7257fbf5a9c0f78a67e4eb73b28a3984d491c5a49ee9aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FA1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
\Users\Admin\AppData\Local\Temp\nsi12F5.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
\Users\Admin\AppData\Local\Temp\nsi12F5.tmp\md5dll.dll

Filesize
6KB

MD5
7059f133ea2316b9e7e39094a52a8c34

SHA1
ee9f1487c8152d8c42fecf2efb8ed1db68395802

SHA256
32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f

SHA512
9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51

Download Submit
memory/2224-112-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2224-92-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2224-97-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2224-106-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2224-101-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2224-113-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download