Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 01:07

General

  • Target

    8cb76c275291f50eb394ce01204e3491_JaffaCakes118.exe

  • Size

    191KB

  • MD5

    8cb76c275291f50eb394ce01204e3491

  • SHA1

    226e5fc79e2144723758000e80d5c1f700786d09

  • SHA256

    b95539dfb9835d070652314dfb1298db75ffa95da04fc113020f131b92e9716b

  • SHA512

    acdb0a91ae39f7d4c5edf68214d82e9a6507ea5877613ec3d5a1eabd9cc449b8669f2a7948174b5920b4f9d3cd587d29fe76b7d5c88638cbeea0ca5bbda20400

  • SSDEEP

    3072:FdTejYQcRkBtZy/kqtcGxekIQ8bqJLSjDexH0THKLW15Y5dyO5SDLm9qJV8Vd1vD:PWfUkBPyrtBxgQTMK0TKpxS3H8j0bc

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cb76c275291f50eb394ce01204e3491_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8cb76c275291f50eb394ce01204e3491_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.gamecentersolution.com/downloadgame.aspx?CID=21157&AID=778
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eb7c70c8e47f1a0b7b9e9b0d49497184

    SHA1

    422d6a3e8d37915f433c1939f6184cf02bc7c735

    SHA256

    4e849911a85c0a4a9e2f03be4c192315e1225b83e82e6cfbb71cd491b79365a3

    SHA512

    bcae884ad5fc7052f9681fdf59b89cfc8e8e986b27f130c8d043b7dd0170d10f1006202879d2025ef5cb1751eeae019080e46010556d5e1722d0340bbea5d627

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0526b433c9668d5eb476bca3c48da8c4

    SHA1

    4d04f74daeeec1f72baddf62c87f43e030641845

    SHA256

    0d3130e118a2ac0f529b5f5c9c3f1220ea5b066b58b27e42d24fed7d0d76d4f5

    SHA512

    d4421e691155d1650885a4e5a6a730854694c7ecccdf90474353ec305ea66b44c30e4447def231865e5439573061da45c959fa65cd5263c27197b9d45304e4ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8c5ac18ae8e2d0f2882c4a85896d3087

    SHA1

    398630e9b4361835ab7bedb55e9e49373efbef02

    SHA256

    4d49bfaa3a537b4f69bfbab7f14e920e554be7683102f43b1b63de4b5ce49a0b

    SHA512

    22b6e55ebf1e45860b3747a2351e292ac44abec2b877ae1c32edb4c36dec5d834b1b11d4a59b7e5f72220da4740270854d2f1b868f0ece31321d8c38e55526c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d519c2db699e8a8bad281c55beca2b05

    SHA1

    fd9ac17b22a4011a0dc94b55ff372dc03910ca8e

    SHA256

    4209561c4d54a3cf81ded56b69e999738425458a02e39e8764d69dad4ebb9aaa

    SHA512

    f2454a94df1d4b91c4763fbf63ab63928857535d509f0b32d9e74387974874f9a276ee4732f140ecbf5c71d0d567cb83d94e87f16c8f77da561e629d1aa5da10

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e2a0b42344883a859aa17983105e3291

    SHA1

    8ba6ea43a92ccbd4c0dcde64199ea7e0c60a471d

    SHA256

    d4baaf66dea632802737ef8192dd68c8264197f5e5b8ebc475699b145bd815e1

    SHA512

    e6ccc43978ed38f738f3b356b8cb3fa080e2f006c1224ea513293e45a6d88edd4f1d156f18d2b5553cd533e4818f2ac4325d8406479cf646781957b81c061f00

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80cd86ae3d3be4aeff44cef2f0c76bc4

    SHA1

    5af6309a6385f762dd2d655dfe919d341f572b61

    SHA256

    5f716ee8dcab1753e18f9568288ca4bf23c95fc943c09904d78051d722fabfd0

    SHA512

    c30ec68884da9f7f1e9585d534ee3776b30ea248a98dc340aa3ec48fcac0ab1aa6f1f609c728507d59f4479084b46ed3282ba589322443656725876c4995705f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    db332ecae8777aef9594244a23f3df55

    SHA1

    e47d5d7cc8c5a5d11f3964f686220906c32fe540

    SHA256

    12e83295ab9c7ad460e3376119584c5a62290421fe1fa53fbcace751eac24987

    SHA512

    125fecf5db6b807998cc69a94cea0a0dc6e4ef5dcf175166ea1863de4a82b74cc617f59219dd7b7b05d41612a790beb5685ce6e2be3f7cae20c46d5dcecc2ea5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6e507993a19fb37c59cc55524d2d2d2c

    SHA1

    abe87f85895850c305ece5742b51df6001726e3e

    SHA256

    663f4f790fa4b30f2666fd9c673fb8b560d1b6adbbe3d0c02ef3438e7a8a28b1

    SHA512

    2f6e99b9270b53ce788c6095f8d9cf11a8aa93dd58806e6cdf6c8146efd15edc983e50098b575cf00da5f363f9a53502ec96aee1ca0606142abcce71273c841d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a5e3800283328b7fec82462cff7de18e

    SHA1

    af9a2269cfa1eec9fd3ffba7aca5363fc8c33017

    SHA256

    7000a30b1b01e5df42bf1c9204ab51d49f07588472459b0679c47a883cb8dcde

    SHA512

    a131e2b1331b4b6240a46ba8cc4b3e1de970558e9d9748fe1ae620a31159dc42d1cf0b3fbdb5c974482f557eebb5adcbfd271eb0d1e96457a6fbf95b48e157ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    74e4c911515d0ba231c3d48641804678

    SHA1

    8a1e0844969cf8a40f561b727e45c6d71edc70d1

    SHA256

    eaf320bbd24a6e0b61a4fb017d419ae91ba7893fd6227c21e8e22189febd0087

    SHA512

    96042b9e6878686cc51c5e5806128dc22c17da717903d5de745296307a0da3901d862178f7ec2cc02eb94bd8f356001411197faf8f4261db04c83f28be2dec4f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ad82cfa32ee4734d768f00b481dbc91b

    SHA1

    49e74dbb15c127b18fa76a8a623de96e187757cb

    SHA256

    60b0444d2ee683a2ce7779365c668ee5a4f4dafb7b3865674fb62a07a0ceb4c4

    SHA512

    1a3198c89613dbf0e3816e44c8196e2235ef63004d879de991ceca84aac6b48051f96805ca892f1a27382214a46cd4e1ddfc93e9db6b2ec19edf461f8fef8a0c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ba08a7cf86999e1d5d3542b1017234db

    SHA1

    95078754a0b01846ec4c7b1e021f8c6200971544

    SHA256

    9442ef533589c0d9e94aa998475c7b4230089561c0256bdf4dc7fa4774daa2a4

    SHA512

    820f0a297490948957a877c1faa5614f0994d1766ed6d865e8a3e6ad081b7fdbedad7d2e8ff1d424b8aae412fdd71c321ac4d1b35950085073dde8501be13785

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d2313a9834bfb73a066484dfa65000a6

    SHA1

    66fdeb11da44bebb3ce186e6f8fd29c05cb32069

    SHA256

    277a99880b234c550b4c622f56b3026cb66dc652e4b9b824d29bfb6a2ab60f70

    SHA512

    f0b8638197cacc2443f3a66540438a445a06f4a710de7c1b32860fbe39b4897388b8b2a88afdd3621b5ded5485a2c223f636d55b76fb2438a8becd26f412057d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    48bdac40e0e3096a6d960af0956fc000

    SHA1

    5a572daac7fbefa6c50b25bbffb75ba972957285

    SHA256

    f8de2e7f2900c378dc883a21c9544708c33f87e661da906e1b0b5d84fdc4373a

    SHA512

    05906e0e8abc26ac80a0ff5af7a47774cc55eede6f668421ca646eb1c7f7e2cd03308319eb3d0e2827c0f47712250f88b85c47dc9ca36233e0c2f5496ff1bd7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    acf731fe7348d01959f81305c4706796

    SHA1

    a1e2341483a025257c1d2a2132ac5657437f3fb5

    SHA256

    f8586b60bc451ad211dd7074502305e478a5c96f471f6b97680fc68dfb24e5b4

    SHA512

    73ffaa6db4da35e821c625eeee5789269f46879dcfe2e6f168734069ff613f4295e21a3d5c2179adc91fc8d1f430b63feafe5956584446679ab72dc686f36998

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e92f2a47b326d1af1336457a272c6a03

    SHA1

    a97c80f33d8189062d5ce3dc58913a64ade9c391

    SHA256

    167fc69b918d53fdd4a66dec3265c120bfc713333a684ce0eaa5d549044fab37

    SHA512

    00745cff216f23a4d71892ba968eab0e6db69597b3011b629e90a7a3a71fb94cf60728e6783f21b230a8ef3b8042cefc93524da85745f59aeb659253fadaa7a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    16faecc85378e299c09828ac11c49f01

    SHA1

    f6a1bd9613a0233a12b93585503c0b1b3115527c

    SHA256

    5a99b1bcb4702a8fa1b7ce2acd130acf6d921e15c51a03bbb8774a65e5128a3e

    SHA512

    58ba92283e6a0a3137a6acacacfd9a752d4e45cf742e514f79bd0eed80ca67b9c73ebcfbc2529ca718cbfc447ef3371f05f0470a84b0b8c2dbd230dc8609d95e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b6d3c650855569462ff348926b7b52c1

    SHA1

    f705cd93ecfb5d75c7a8e4c5a4d6d3290b9e1c94

    SHA256

    335a90e4dfef6dffd04047d34a5197fde482a0b5355231362c27f4b321fce4d3

    SHA512

    6625acbba781d9191d5ac4c528e424e24c5c8ee482b69a989313f3f1f08bd52ca17f724c2dfb0a9f16d7e021f4d5f9f03dec9c040f0ba7fb744755fc88130f81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    088fd81ea3f997718281af947c5587d0

    SHA1

    b9df50585842348e51ab7fb520b58f45196b2b1c

    SHA256

    b2f7fde5da1c06164e95f89d7eb96e93d3b6b8a5e601b8567535a6b8d60700de

    SHA512

    849d8cb8bc1b518e7e3b7a6f3c76f45c8872f44dee3e2c04aa886bd1cbbe218ecc7316cba5f3ccf55e8f41d10268d716cd6d621358e355adb859b63144eaa5b5

  • C:\Users\Admin\AppData\Local\Temp\Cab88F0.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8971.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2360-26-0x0000000000400000-0x000000000056B000-memory.dmp

    Filesize

    1.4MB

  • memory/2360-0-0x0000000000400000-0x000000000056B000-memory.dmp

    Filesize

    1.4MB

  • memory/2360-24-0x0000000000400000-0x000000000056B000-memory.dmp

    Filesize

    1.4MB

  • memory/2360-25-0x0000000000400000-0x000000000056B000-memory.dmp

    Filesize

    1.4MB