74da5a8247dac595070b9d99f69bd73d00a17da42ce9553f9716984d9df21220

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe
Size

90KB
MD5

8360ebb8a4d75d0682ca8aca5ec72d1d
SHA1

38493fd4d524d9989d2ad0a75aec4734a39c70d7
SHA256

74da5a8247dac595070b9d99f69bd73d00a17da42ce9553f9716984d9df21220
SHA512

c021c13eff45ef6790ca7c7a6cee02d94dfd9ef40e6b1e5ad0ea70b4b32acaa2ba24b53cb70c793213dbf88e9f4b5a9805573fd3ffc08c0673f43db1cb1f0115
SSDEEP

1536:enMRTar5I1g9BmSf0skeE9VkhoyVVq8sRuEhZbMHYgeO9HG2:jTu61gBjCfkuyvq8sRxhdirRm

Score

8^/10

discovery vmprotect

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\windf.hlp	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\windf.EXE	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\windf.EXE	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2404	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2404-4-0x0000000000400000-0x0000000000438000-memory.dmp	vmprotect

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Wizet\Maple\npkcrypt.dll	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe
2404	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2404	8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8360ebb8a4d75d0682ca8aca5ec72d1d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\drivers\windf.hlp

Filesize
51KB

MD5
7be9468a3f4aee968adcc66ebaae125e

SHA1
443f6ad1702d40a75dfcd14805bf97a3bfd36b75

SHA256
aa2e89eac176d85c2491aa95b0cc49d45147150a525f29aea56c77490713cb5f

SHA512
52711a22815fdada4b314dc2834e3c659b0ba1aaa4c85ff1105ffd1d58633c45bf49fbb49155b3fcac253ad02826786e42a0108770627b84679d1257b9a34de5

Download Submit
memory/2404-5-0x00000000003A0000-0x00000000003C6000-memory.dmp

Filesize
152KB

Download
memory/2404-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download