222745facca65004689cc6fa5f3cd6ce931e86928e00dc555315aea72fac1e86

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe
Size

3.7MB
MD5

6fe6dd54bcace1aff1a5903288c11f3e
SHA1

133d97c403da2a15a51705932941aeafaa98b256
SHA256

222745facca65004689cc6fa5f3cd6ce931e86928e00dc555315aea72fac1e86
SHA512

6f8453b054e1a67aff11ad1804a3847a2040875ef112f7ff58fccf7d3ba23e2cb26420e1c2d30df1038d65f15ca7f5dc94f2222ae495067a04d9a89f4d592ffb
SSDEEP

98304:L8RB7+lrZU6mNEP4WMgrj4sGo3lOXg/HmwqNo3YIQJzeAAnq:LS78rZU6mSNMAMsbxOjmoIQJzeAMq

Score

7^/10

discovery persistence themida

Malware Config

Signatures

Themida packer 34 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2644-3-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-4-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-5-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-6-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-7-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-8-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-9-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-10-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-11-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-12-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-13-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-14-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-16-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-17-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-18-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-19-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-20-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-21-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-22-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-23-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-24-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-25-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-26-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-27-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-28-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-29-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-30-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-31-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-32-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-33-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-34-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-35-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-36-0x0000000000400000-0x00000000011E1000-memory.dmp	themida
behavioral1/memory/2644-37-0x0000000000400000-0x00000000011E1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Win32Update = "C:\\Arquivos de programas\\Win32Update.scr"	6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PsyCho_killer.Xapada0	6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2644	6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6fe6dd54bcace1aff1a5903288c11f3e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-1-0x00000000011F0000-0x00000000012CF000-memory.dmp

Filesize
892KB

Download
memory/2644-0-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/2644-2-0x0000000000401000-0x0000000000462000-memory.dmp

Filesize
388KB

Download
memory/2644-3-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-4-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-5-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-6-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-7-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-8-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-9-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-10-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-11-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-12-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-13-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-14-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-15-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/2644-16-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-17-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-18-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-19-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-20-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-21-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-22-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-23-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-24-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-25-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-26-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-27-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-28-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-29-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-30-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-31-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-32-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-33-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-34-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-35-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-36-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download
memory/2644-37-0x0000000000400000-0x00000000011E1000-memory.dmp

Filesize
13.9MB

Download