fe1bc0c1857dae3efa618f5a171adc4238b4ff909335825c6b91ee188b659bfc

Analysis

max time kernel
140s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe
Size

18KB
MD5

710f87189a98d07910d2de99d8e29577
SHA1

6de19ce1d3fd378241044cec5e8bb778a96f3ba0
SHA256

fe1bc0c1857dae3efa618f5a171adc4238b4ff909335825c6b91ee188b659bfc
SHA512

bb8a2856e00235665be8c3799162f8c0fb1b09d9578c458c0d22c3d0b107857c2b9bfb6d06583216358fef2c30c97fb45f0a05dfd84bbee25edd9f15acc84d2d
SSDEEP

384:c43VSU/w1ri9Jl3X9RI+qTeTU6vTLveJ4fO75pGmIk:j3KrgfPInbQLveCfO73

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a000000016b9b-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1900	710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000016b9b-4.dat	upx
behavioral1/memory/1900-6-0x00000000002A0000-0x00000000002B0000-memory.dmp	upx
behavioral1/memory/1900-7-0x00000000002A0000-0x00000000002B0000-memory.dmp	upx
behavioral1/memory/1900-10-0x00000000002A0000-0x00000000002B0000-memory.dmp	upx
behavioral1/memory/1900-17-0x00000000002A0000-0x00000000002B0000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\710f87189a98d07910d2de99d8e29577_JaffaCakes118dw.dll	710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\710f87189a98d07910d2de99d8e29577_JaffaCakes118dw.dll	710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1900	710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\710f87189a98d07910d2de99d8e29577_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\710f87189a98d07910d2de99d8e29577_JaffaCakes118dw.dll

Filesize
16KB

MD5
37962ebbe9c78808fcd9391249274137

SHA1
fbde067b4f9aa67f2fde3f389f595e8201cd6ef5

SHA256
1119df66f8baa48e3d370392c25989089133fdeafdd8e0a5d0d0414a8a24b532

SHA512
ce06a026caaf35f8bd96bb84b5a1908fdb827c970364c4d923eef3a90f7852ab924c60803aae3e701c9af48cd82242e48be64df4c3e14b8f1b2ec4687d8dd05a

Download Submit
memory/1900-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-6-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1900-7-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1900-9-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1900-10-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1900-17-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download