2f49c91a07823afd611a71ed0b4ad9e2731471f2fe7f8f908b13f3a3b7883b16

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

761f26ec7b13152cad9be63fd5e703d5_JaffaCakes118.exe
Size

90KB
MD5

761f26ec7b13152cad9be63fd5e703d5
SHA1

c3e3e6f93219e6b4eb2bc00975b2ade0394e31c4
SHA256

2f49c91a07823afd611a71ed0b4ad9e2731471f2fe7f8f908b13f3a3b7883b16
SHA512

968450e4a2183b1707202b5ddbb5c40d437542efea57ac8073b2c4842192f888d8cdf3d21aa0b3facc8ca8832308b74cf7a907c1a57058f9c83194ab81d4cbdf
SSDEEP

384:Ca73O2qsKOI9UwTPs5VJUeezXYKs25gkOYBS54n8jo7:CXqI9UcPKVJUeezXHdvnz7

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2076-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2076-16-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	761f26ec7b13152cad9be63fd5e703d5_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	761f26ec7b13152cad9be63fd5e703d5_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "about:blank"	761f26ec7b13152cad9be63fd5e703d5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\761f26ec7b13152cad9be63fd5e703d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\761f26ec7b13152cad9be63fd5e703d5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\explorer.lnk

Filesize
254B

MD5
9bf04053f293233535fb2f81fe62488d

SHA1
be0fcc797ccd79250026dc4fce93b34a3d8e6a37

SHA256
094362a29bf9d748e3d12d4498d13f41b9872e1816c513bb2a09686a6eea0acc

SHA512
8bdb88ed7eb432865c01802957c05484a323146186b3562bf5e5dc7c776e16d072a93ed6524ee9088fffefb7f8872ba8f91d4e6a895409312de653d4bd944202

Download Submit
memory/2076-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2076-2-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2076-8-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2076-10-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2076-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2076-17-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2076-18-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads