f80c412c21b19b558467e90f06fc102b236dc0ea6ba5bf053155655920c5a7a7

Analysis

max time kernel
142s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe
Size

2.5MB
MD5

6143736cbf1e558288fd36e7783e3fe0
SHA1

dd702d462ce6bef77696f8c9262e637757dd9eda
SHA256

f80c412c21b19b558467e90f06fc102b236dc0ea6ba5bf053155655920c5a7a7
SHA512

44ced96cae6bf90be28267cbf973495a3c6f2cee31f652af32b86eaf008392e122f6cb7d25ac46457cc3e4e1a71915563c4563cb09090a4b6497f21584c97bb6
SSDEEP

24576:hWO0o2929Hr9jNJWPpbGSNcceVYDcbxFUSxC1RcZtbS8BlDBtbzKwY19Ga1b7y2C:QOnZHrnoPp1ePxSj1Rs33bzHO19uV

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002346a-10.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
1216	6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe
1216	6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1216-0-0x0000000000400000-0x00000000005A5000-memory.dmp	upx
behavioral2/files/0x000700000002346a-10.dat	upx
behavioral2/memory/1216-16-0x0000000004F90000-0x0000000004FEB000-memory.dmp	upx
behavioral2/memory/1216-15-0x0000000004F90000-0x0000000004FEB000-memory.dmp	upx
behavioral2/memory/1216-71-0x0000000004F90000-0x0000000004FEB000-memory.dmp	upx
behavioral2/memory/1216-72-0x0000000004F90000-0x0000000004FEB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1216	6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe
1216	6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe
1216	6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6143736cbf1e558288fd36e7783e3fe0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{9E98AF10-8BE3-4F01-9B6E-5B9ECEB6B276}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{ACE94767-DA4E-4DDB-A240-BB09E9494B14}\css\style.css

Filesize
2KB

MD5
7757619b8df51d677c79395a84e0c539

SHA1
8fa1685f830da61a0f4bbdb1db428f4dbef9c971

SHA256
7c8000bdae47f22b1db799db5e583902737de0fe37bf2581b18bedb63155b1a3

SHA512
3b779b7e4694bf11600b802ea690871f7e65f880c56b5b76fbb0ceede64feee143f6d23031dc485510cb496dad89705999f2e66d4df2390ca318570ff6c7d731

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{ACE94767-DA4E-4DDB-A240-BB09E9494B14}\images\cellar_bg.jpg

Filesize
548B

MD5
4777779f71fde6d16f6cc99013c8daff

SHA1
312f97b25bd743a8a8d2268bdfd1ac53701345c2

SHA256
46e860286f1f016711f9e6a8b36335ba549c58aadd67322dae897c0f83c06cd2

SHA512
1b4cc3e5613c6bef54b47d23a53315f802a016d5961b81b4eab4012c8da1045fae3af486c97e281f9829d83f9190af29e685be2b3bf3ebc89cbbf0d4fcf5e775

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{ACE94767-DA4E-4DDB-A240-BB09E9494B14}\images\index_top.jpg

Filesize
26KB

MD5
05c3582a4efb14334262dec9320b8ac3

SHA1
0c6d42c0f417c05ae285327b49002474021e4703

SHA256
48f5f24c3b2b24c244cf7211dd9804557436d6e617d9891e308934f32c2301c1

SHA512
f4532bf0d0676f64dd114139a86049c093c61c3926a929a2652d7f7d724dcb7505c03bbac3687c7a56f313359d5022137ffa25035d69cf2f91a745f867a124d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{ACE94767-DA4E-4DDB-A240-BB09E9494B14}\page.html

Filesize
1KB

MD5
208bf1089774167723e951ea69f6e60c

SHA1
6749d9193301e617997a0b1db2c5d1441b6477a5

SHA256
e3838c923b1e2f95d8be973d7e149f984bdcd03109648be0a80d1d4ab499e35b

SHA512
d5d42863cc001e2a66ada472e8bac3114a026e1927018f1ecb48e5f21743b4db770360e66522d86c3adb22a73a3e53b7a78e91c47a74135bb35531238d3618e0

Download Submit
memory/1216-6-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/1216-15-0x0000000004F90000-0x0000000004FEB000-memory.dmp

Filesize
364KB

Download
memory/1216-16-0x0000000004F90000-0x0000000004FEB000-memory.dmp

Filesize
364KB

Download
memory/1216-0-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/1216-2-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/1216-1-0x0000000000720000-0x0000000000726000-memory.dmp

Filesize
24KB

Download
memory/1216-68-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/1216-70-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/1216-71-0x0000000004F90000-0x0000000004FEB000-memory.dmp

Filesize
364KB

Download
memory/1216-72-0x0000000004F90000-0x0000000004FEB000-memory.dmp

Filesize
364KB

Download