56176d7434fc711e087d8a2d75a10240cefeefc2608dc6abf85774cf1c89e2cf

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

957926027be368f01b972b6404f62b5c_JaffaCakes118.exe
Size

201KB
MD5

957926027be368f01b972b6404f62b5c
SHA1

0897684a1f64f68da3ca7751fbdb142f1d344a78
SHA256

56176d7434fc711e087d8a2d75a10240cefeefc2608dc6abf85774cf1c89e2cf
SHA512

ad3b06b144e8fb5e676e3c99dc9c059660fa17b3fca410836be56ed362a879dd76f9838fab27d404fa9513736fe3994f579d3a78c6d8e6a8ac5be7e85bce855f
SSDEEP

6144:PIdRkLibTOTHaK8uzzTnI0NE8nFCSY96npE4g6zY:oOGbTAHaDuTI0NE8pN

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000016ce3-2.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1820	957926027be368f01b972b6404f62b5c_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016ce3-2.dat	upx
behavioral1/memory/1820-6-0x0000000074FF0000-0x0000000075018000-memory.dmp	upx
behavioral1/memory/1820-36-0x0000000074FF0000-0x0000000075018000-memory.dmp	upx
behavioral1/memory/1820-64-0x0000000074FF0000-0x0000000075018000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	957926027be368f01b972b6404f62b5c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\957926027be368f01b972b6404f62b5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\957926027be368f01b972b6404f62b5c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\vrxaaa.dll

Filesize
72KB

MD5
46b7065b224ad9cbc24ef66f2feb36da

SHA1
25103f9e3a12d9a444c5079d53f0bc5f1c62a3fd

SHA256
e35107e13c296de7a13f7d4307b0f5a2e4802e14e597c1fe303eba3049515185

SHA512
1e66767384eaae1c0fbd755954eb9d81ad9004fe1442b95284ca5c6bb808e80d3148ea705ab683584441650ab364a33ca48c51d00b7fa458dbdf027e6459b14b

Download Submit
memory/1820-6-0x0000000074FF0000-0x0000000075018000-memory.dmp

Filesize
160KB

Download
memory/1820-36-0x0000000074FF0000-0x0000000075018000-memory.dmp

Filesize
160KB

Download
memory/1820-64-0x0000000074FF0000-0x0000000075018000-memory.dmp

Filesize
160KB

Download