4cdb1f2860f0eeb7d8fddf08f3fc358e30c90dfbafb561f655d2d8d76593e23f

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe
Size

27KB
MD5

a1956b60215576f21c4dbbd9db55aec2
SHA1

e6c19fb44ce6a16d382b7af98e0004d26b7e6fab
SHA256

4cdb1f2860f0eeb7d8fddf08f3fc358e30c90dfbafb561f655d2d8d76593e23f
SHA512

81cc7ec0fd76dc05a4449eddc3006fb0a8710272a8ef9a868b2e1e8897ccfeb11dc22d2eb460b016da5a7ac550aa756a9de2eeaf38887f20f56251b88b197913
SSDEEP

768:eLKlaHU2TZniXlA2r+1PHQxkAJvSGrof1z:eelaHXtiSUSPU/RSG0

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000016d58-3.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2728	a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2728-5-0x00000000002A0000-0x00000000002AF000-memory.dmp	upx
behavioral1/files/0x000b000000016d58-3.dat	upx
behavioral1/memory/2728-7-0x00000000002A0000-0x00000000002AF000-memory.dmp	upx
behavioral1/memory/2728-11-0x00000000002A0000-0x00000000002AF000-memory.dmp	upx
behavioral1/memory/2728-25-0x00000000002A0000-0x00000000002AF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2728	a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118ow.dll

Filesize
15KB

MD5
e00242fb4d23093d022467d144181cb2

SHA1
d52628b7aa84bf2bbb908dfa9b1ba6be53520a1f

SHA256
08c7f348de0da18007ee206de69a39645dfb033108d752b1061fb8ff21241206

SHA512
ae70fc56c4582295f031695713611ff735c7935f5509c18d9054c50dbd4b64fc29f594810bf4f0904c929f296d2857153c40fdb4108582ce79358a76ad8415d6

Download Submit
memory/2728-5-0x00000000002A0000-0x00000000002AF000-memory.dmp

Filesize
60KB

Download
memory/2728-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2728-7-0x00000000002A0000-0x00000000002AF000-memory.dmp

Filesize
60KB

Download
memory/2728-11-0x00000000002A0000-0x00000000002AF000-memory.dmp

Filesize
60KB

Download
memory/2728-25-0x00000000002A0000-0x00000000002AF000-memory.dmp

Filesize
60KB

Download