dd61b88c6f12e687ca807494b8986529b9ef9d5d92e1d24d4bad3a4689ed9ec8

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe
Size

2.3MB
MD5

96c0054f42e3da2144dec1aa07bf0f29
SHA1

b5b2b58f03f3abdebb5315526202b92d11c7528e
SHA256

dd61b88c6f12e687ca807494b8986529b9ef9d5d92e1d24d4bad3a4689ed9ec8
SHA512

06b2927038ad08393cb5d6db0423b2520d36c0f4cb38db19ca78bcba473e0192b745cef80468e2c69f1740ed4bf7ab4531a81856931562d7a3bbb59c80f77e1e
SSDEEP

49152:7uidRXoCBlVLxYDdVmvSe7TBc5FMW2L5NygGwbLm:iiQC1xYaz25FMW22vKLm

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000019214-10.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2976	96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2976-0-0x0000000000400000-0x0000000000578000-memory.dmp	upx
behavioral1/files/0x0007000000019214-10.dat	upx
behavioral1/memory/2976-12-0x0000000003680000-0x00000000036DB000-memory.dmp	upx
behavioral1/memory/2976-73-0x0000000003680000-0x00000000036DB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2976	96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe
2976	96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe
2976	96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96c0054f42e3da2144dec1aa07bf0f29_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\css\style.css

Filesize
2KB

MD5
bf7569fd66b7a398330ab7c1c31965a4

SHA1
efebe9b76fa49deda68efebfaed68f8b4880051f

SHA256
e34727af72f99606ffba57b2cacbcfb101e17fac2f86462d4bde8ff66024eba7

SHA512
2266db6fbbe0ae92c87332e13157114c5f2a72265b74e333bed6ae884346bdb1194b40c0fa127c05ad9287a2b5b80e864ab809b72f971abe02eb510ed2715f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\images\bg_bottom.jpg

Filesize
351B

MD5
f76e35ee80fcd4052ec4e4106a13f2d7

SHA1
1ccb169d78851733e3a384828c06021e1fdd279a

SHA256
a386a4e102b734e6085daa926d3a3950fcbe3c1631018d693095c17e86952a30

SHA512
ce6fc685581e784d1adcd8168c245bfcfe5868657be94c45459c533e318393123245d3a1eac9f6926bc0006dc520848ba6ce00e6a08889e3dd502c706fb1cb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\images\btn_install.jpg

Filesize
3KB

MD5
de97d4ffab1f89b692e05ae961aa2535

SHA1
7d44832261c41732db3522633c29a3abe9e0f662

SHA256
2eb33619ce06d76dd65e5b0196825ae11e089745af9549455cbe0a0c0356b117

SHA512
8f62c62d779bfd8184e21ca4ac533f6619d19c478333e6172015a7413df4743129ee17fad56390ce2e9dd1bdb1f41dd1af181cd43f8ad28e87abb0e8f76395dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\images\btn_quit.jpg

Filesize
2KB

MD5
a47dc0b965f9c5a12645a7cdce093963

SHA1
05efd59dcfd9bb580a2c2a10ffb83a1c7c0f0cbc

SHA256
f62f2bc6e542ec755f182d257c80d3b14d5c968ae52a2062239daf80445d3b42

SHA512
66867c0c94c2d651eace3fdbb498a86f68163502d70a0bb72ba3554de48818e60634471f6778e35dfbf7a5563d89b02eeeb93731557ee82949324da3df266d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\images\index.jpg

Filesize
19KB

MD5
53a64792cf0cf4184e6f925888a3fe4b

SHA1
3a242b9abf7c5d7722d0db3f864d1e58089577e3

SHA256
786d13444e1f52f3263ff9ace9e28b1dd4e5b897ab153f9bfec13050f87389fd

SHA512
e0d1fa6d50d4da2d780948e08eae474de9ae72ed54fb2554d0b6e50152f92be822fa500972ac56091631b445caa542ff927de36ef23edc203597e18dfe9ff3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\images\text1.jpg

Filesize
12KB

MD5
9a58c8baf22f4a76e6b119100a6e51f2

SHA1
1f86835339b552a3b6e67a15b2cfb9ab75037364

SHA256
b37196ce78804826cec7c75b398a9f434979cf3426c12de26c3210d4b89173e1

SHA512
6348e4bab6a92ad928253772171871592ca458bcb3d65beb82f64e8fbbf07d4e7d7a0fb1c86097dc182303a8055e17f3745d162536becd0c55cbf56363122bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\images\text2.jpg

Filesize
4KB

MD5
1965a6e2723f1370a3291a758d22701d

SHA1
59149b9630986114f82937cb92c3298cc52fe024

SHA256
9c33cc36d582d12421298180b6acf3856ee59485d4567c2fbd4c77bebec564d2

SHA512
f38decc62a42c6e53e05b95d8d82511ab82a802a7f93cd8a4b5f6dde28f8e310844276ff142e4096aaad4e7228b769cb90b988d30167b76cef5cc0e94650b067

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{B5B1DDBB-AF60-4583-A8CE-D3B366C10CBE}\page.html

Filesize
1KB

MD5
b1202239a7ac2830454e9dcc8b9decb2

SHA1
e7e48a045aac175820c36e28f6d1ec5a67252d07

SHA256
4c2fdb58d6fa76b9ed5152eeb4c615b26f339ebf9b7573cf73c96f3dc363a7c7

SHA512
212016016368ff647e533d8886ca6c41d288ac37c83db2784591f66f740ca314d823d16396538aa18c69910321436892c05a4c93f959acdb52f40c08cc2b8fdb

Download Submit
\Users\Admin\AppData\Local\Temp\{B4BED237-0727-441C-A5D7-C041E1D6DA8F}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
memory/2976-12-0x0000000003680000-0x00000000036DB000-memory.dmp

Filesize
364KB

Download
memory/2976-0-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2976-6-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2976-2-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2976-1-0x0000000000710000-0x0000000000715000-memory.dmp

Filesize
20KB

Download
memory/2976-70-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2976-72-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2976-73-0x0000000003680000-0x00000000036DB000-memory.dmp

Filesize
364KB

Download