e6c11cdede4239d78e79f8a2e350f2eb0c02a558b7d2d40172c2527a52f6b536

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
Size

837KB
MD5

89cf0d9162ae8086f2bfdbd699181dd0
SHA1

85c218fd5f4ddc10529af6e25cf51743f2d0e64f
SHA256

e6c11cdede4239d78e79f8a2e350f2eb0c02a558b7d2d40172c2527a52f6b536
SHA512

9ae3a9378e3ca26a1b7241ae89ed8384964c9d19e19790b1bdc03171359ef2e584d3b5088bec697d6a575d3ca1509f0f0dfb027dc79fd4fe1bdd01567129a420
SSDEEP

24576:rhtsmES7SEpUuj2pjaeMzdimI/8HP7F9z9YGs6:rhv2EpUy2pjnMzdXP7F9zv9

Score

7^/10

discovery

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000012272-1.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
3044	89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89cf0d9162ae8086f2bfdbd699181dd0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
200KB

MD5
65b0e75944035c5c8812eabb0c269d6f

SHA1
2baf2dd9d8c1b1c8872b131ff59002e2a4b78e2f

SHA256
a4308bdc3b42ed3c93ab9aa7ed408cdb760dfc4bfacd93b2431e127478630511

SHA512
0dcce11d619a8b6955565502623ce677fcd2623f889c925c292ea68d6511df8a9a208a47f4e3066811ed74da0700a0445435c3b49df67b555c9bb7aadc46674f

Download Submit
\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
cf46bb62a1ba559ceb0fad7a5d642f28

SHA1
80b63dd193e84bfacbe535587dd38471b8ea2c24

SHA256
fe4bba1a99b332c8bbd196d3a2f3c78d9edc8f212842ff2efef17eba38427f67

SHA512
1f71f31fdc1ef7695d7a6e79218a9192804178bb2af80486de4f8ff3d7e176860813a61fa265bf78fe4ff722a85b72798938d715d8a2a034ac759505197a1058

Download Submit
\Users\Admin\AppData\Local\Temp\tdl21C3.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/3044-15-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download
memory/3044-11-0x0000000000220000-0x0000000000293000-memory.dmp

Filesize
460KB

Download
memory/3044-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3044-18-0x0000000000220000-0x0000000000293000-memory.dmp

Filesize
460KB

Download
memory/3044-20-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download