221fa43d7308058d12608cbd6fd67ca20dd847022d2afb7507a55c4e782cf7b8

Analysis

max time kernel
140s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe
Size

22KB
MD5

84cd977f9eaa652c2e1626ef813bd0c7
SHA1

cf2aa3b68438a3bd09c9171806f47bf618edf83f
SHA256

221fa43d7308058d12608cbd6fd67ca20dd847022d2afb7507a55c4e782cf7b8
SHA512

a983eb5ef93ea5f9d84c826bbc174c47ea541b403b63237cc722a95e0af3e16a6cc83f3ec3c33166cdbbc1329105b7a0d684cb71620fd09d34db34b135789856
SSDEEP

384:qfUgnx2T/pZxYvREAQduoxBZIRYZwl4bH10tGXb0zgd5enq6nwhNcxlrbbd6zeoM:qfYWZE0oxBZk8yg10taYOk7lrf3nJ

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000120fc-3.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2880	84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fc-3.dat	upx
behavioral1/memory/2880-6-0x0000000000290000-0x00000000002A2000-memory.dmp	upx
behavioral1/memory/2880-7-0x0000000000290000-0x00000000002A2000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118hd.dll	84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118hd.dll	84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2880	84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\84cd977f9eaa652c2e1626ef813bd0c7_JaffaCakes118hd.dll

Filesize
19KB

MD5
de6390614861cd994dc609237455ff09

SHA1
3b17f6be4a34855f779a23cf3e6c278c435c3553

SHA256
a1f585b96b97afe981dba6a649f522657533b7bcbe51986ff68a7023e76b71c7

SHA512
5bda2dc42274c545051aba19d8be4bc37ac5d50fc73dfd749c1786ae0a29fb4cb6e239857f621b1199416240372bd2db34980870965524ac7c49b14b211f472f

Download Submit
memory/2880-6-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/2880-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2880-7-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/2880-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download