e57b80557d0a3867c6c58250eafef39412c5e0ad5cdafc18084497d55832f4f8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe
Size

179KB
MD5

68218bbeefebc9ae1df37d27988b98be
SHA1

8e8cea39200dc0462d094c6a651cdeb415751ccf
SHA256

e57b80557d0a3867c6c58250eafef39412c5e0ad5cdafc18084497d55832f4f8
SHA512

69782592c2cc0193a1f1b63d0e02f736f98fee6169abafd19955f9bd2810923d503a46df5938e9108ff1f4c02663b85e2b6c3a7097272d1d715b6f8676c273f2
SSDEEP

3072:SnyIOV+y8cO6ntl8muGa/N7vQ3jZ6Prhl4nm+7jq7Hdpzdv2YSj/isUivKHX9G:SyII+NSuh/N7vQtQ4pOtkj/ismH

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4800-2-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3580-12-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3580-13-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/636-102-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/4800-103-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/4800-183-0x0000000000400000-0x0000000000470000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3580	4800	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe	86
PID 4800 wrote to memory of 3580	4800	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe	86
PID 4800 wrote to memory of 3580	4800	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe	86
PID 4800 wrote to memory of 636	4800	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe	96
PID 4800 wrote to memory of 636	4800	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe	96
PID 4800 wrote to memory of 636	4800	68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe startC:\Program Files (x86)\Internet Explorer\lvvm.exe%C:\Program Files (x86)\Internet Explorer
  2⤵
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\68218bbeefebc9ae1df37d27988b98be_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\148B.506

Filesize
996B

MD5
705300fcdd15607c7bd79008b9e9186d

SHA1
ef731fa57d0e931f427502992d3fade9319c8954

SHA256
32f70849e133af2a8ddc9a8e54abb1c7ce85ba5e912292228404a53a58a8f501

SHA512
84dedf506bec2c79eea35fb1649151ef98c3eb7fde4f5446f39dceca56cdaacc90147b3a05ebbcbb17f7811002c0ed53da405c0c084a45835d4c8b6c068dbdec

Download Submit
C:\Users\Admin\AppData\Roaming\148B.506

Filesize
600B

MD5
0b019d4f1030721f2d504300dbdfd880

SHA1
ebc77fb57be35e307f94cd5fdbc1fa538135c44a

SHA256
f0a66873cbfb6e9d148cb327a113f0f1325d3a1d1d81092680bfbc375d7c5b12

SHA512
3b82ab5923305a35e52afe89d47d5aaf090d717582d79bcd5cf6fd00100b2b7e19573a4fe5fc7e86b3bff05a2e66808d726010c181979e9389cee6e782141351

Download Submit
C:\Users\Admin\AppData\Roaming\148B.506

Filesize
1KB

MD5
6a2525a906e59247caac5a3269465774

SHA1
590fa8910c6233ca828023c66501667f31bdb34a

SHA256
a175a9851e1b303ad02b8c9fa1a2c76fe4c31a30cb97352c42a4723d4cae89b3

SHA512
d3d093fba5cf1e208f8d955a3784790786c7c6543d43a98875c1221d2b3a2de73c797a20abebc7212d01958c96014eb53ac12308971956895a06e3e4afe6f265

Download Submit
memory/636-102-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3580-12-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3580-13-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4800-1-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4800-2-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4800-103-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4800-183-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download