fa195425335759666e682aeed61a9b6bd8096891bc6467ee499354e5407b20e9

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
Size

44KB
MD5

863a24fedaee79aa7c7d99a670093378
SHA1

be26b889ef7f86126e81c0da735bf2697000a2d4
SHA256

fa195425335759666e682aeed61a9b6bd8096891bc6467ee499354e5407b20e9
SHA512

47a4a54ad12b14e0d2ae7577a9b2556ad7449a06e18c53365a221396a3040bbaf8df2d0cbb31e9b044e07265d1b1691b856773f3cc6e3e659b1618c77fe24b45
SSDEEP

768:sD+3gRHn3upoJD4iiNMXPgGRwB6Q3jq4kpD2I:sKgR2oJcisJGGI4k

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2760	winlogon.exe
2052	winlogon.exe
1932	winlogon.exe
2040	winlogon.exe
2164	winlogon.exe

Loads dropped DLL 3 IoCs

pid	Process
2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
2760	winlogon.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-6-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2244-4-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2244-2-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2244-8-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2244-10-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2244-9-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2244-25-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2052-36-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2052-42-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2052-43-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2052-54-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2052-69-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2760 set thread context of 2052	2760	winlogon.exe	32
PID 2052 set thread context of 1932	2052	winlogon.exe	35
PID 2052 set thread context of 2040	2052	winlogon.exe	36
PID 2052 set thread context of 2164	2052	winlogon.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
2052	winlogon.exe
1932	winlogon.exe
2040	winlogon.exe
2164	winlogon.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2244	2208	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2760	2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2760	2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2760	2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2760	2244	863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe	31
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2760 wrote to memory of 2052	2760	winlogon.exe	32
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 1932	2052	winlogon.exe	35
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2040	2052	winlogon.exe	36
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37
PID 2052 wrote to memory of 2164	2052	winlogon.exe	37

C:\Users\Admin\AppData\Local\Temp\863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\863a24fedaee79aa7c7d99a670093378_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\E696D64614\winlogon.exe
      C:\Users\Admin\E696D64614\winlogon.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1932
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2040
    - - C:\Users\Admin\E696D64614\winlogon.exe
        
        "C:\Users\Admin\E696D64614\winlogon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\E696D64614\winlogon.exe

Filesize
44KB

MD5
863a24fedaee79aa7c7d99a670093378

SHA1
be26b889ef7f86126e81c0da735bf2697000a2d4

SHA256
fa195425335759666e682aeed61a9b6bd8096891bc6467ee499354e5407b20e9

SHA512
47a4a54ad12b14e0d2ae7577a9b2556ad7449a06e18c53365a221396a3040bbaf8df2d0cbb31e9b044e07265d1b1691b856773f3cc6e3e659b1618c77fe24b45

Download Submit
memory/1932-52-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1932-51-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1932-45-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2040-67-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2040-66-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2052-43-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2052-69-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2052-54-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2052-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2052-42-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-25-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2244-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download